Secure Generation

The main @ppabari/strio export provides cryptographically secure generation, built on a bias-free (rejection-sampling) Web-Crypto engine.

import {
  generateRandomString,
  generateRandomStringAsync,
  generateId,
  generateExpiringToken,
  generatePassphrase,
  PRESETS,
} from '@ppabari/strio';

generateRandomString

generateRandomString(options?: RandomStringOptions): string | string[]

generateRandomString({ length: 32 });
generateRandomString(PRESETS.TOKEN);
generateRandomString({ length: 10, charset: 'base58' });
generateRandomString({ pattern: '####-AAAA-####' });
generateRandomString({ length: 8, count: 5 }); // → string[]

Key options: length, numeric, lowercase, uppercase, symbols, readable, exclude, charset, startWith, prefix, suffix, pattern, count, seed (deterministic — not secure, for fixtures only).

An async, non-blocking variant is available as generateRandomStringAsync(options).

generateId

generateId(options?: ShortIdOptions): string
validateId(id: string, options?: ShortIdValidateOptions): ShortIdValidateResult

Collision-resistant short IDs with an optional Luhn-style checksum character.

generateId({ prefix: 'usr' }); // → 'usr_K3xP9mQr2L4Xc'
validateId('usr_K3xP9mQr2L4Xc', { prefix: 'usr' }); // → { valid: true, ... }

generateExpiringToken

const { token, expiresAt } = generateExpiringToken({ ttlSeconds: 900 });
verifyToken(token); // → { valid, expired, ... }

Self-describing tokens that carry their own expiry — ideal for magic links.

generatePassphrase

generatePassphrase({ words: 4 }); // → 'stone-river-proud-flame'

Human-memorable passphrases with an entropy estimate.

Secrets & keys

import {
  generateHexKey, generateBase64Key, generateJwtSecret, generateApiKey,
  generateOtp, maskSecret, timingSafeEqual, generateCookieSecret,
  generateAesKey, generateNextAuthSecret, generateDjangoSecretKey,
  generateRailsSecretKeyBase,
} from '@ppabari/strio';

Framework-ready secret generators (JWT, NextAuth, Django, Rails, AES, cookies), plus maskSecret and a constant-time timingSafeEqual.

Entropy & validation

import { estimateEntropy, validateRandomString } from '@ppabari/strio';

estimateEntropy({ length: 20, charset: 'base62' }); // → { bits, strength, ... }
validateRandomString('abc123', { minLength: 6, requireNumeric: true });

Charset aliases

Pass any of these names as the charset option (in generation and in the /str toolkit’s random helper).

Alias	Characters / use
base16/hex	0-9a-f — hashes, color codes
base32	RFC 4648 uppercase — OTP secrets
base36	digits + lowercase — short URLs
base58	Bitcoin alphabet, no 0/O/I/l — human-readable tokens
base62	digits + mixed-case — max-density alphanumeric
base64url	URL-safe, no padding — JWT parts, URL tokens
alphanumeric	alias for base62
alpha	letters only, mixed case
numeric	digits only
crockford32	human-friendly, excludes I/L/O/U — redemption codes

The full mapping is exported as CHARSET_ALIASES.

📖

This page is a quick reference. For every option and edge case, see the README.