Six fixes, each with a test:
1. Character pools are built as arrays of code points, so astral characters
(emoji) are never split into lone surrogates. Entropy counts code points.
2. Boolean options are parsed strictly: true/false, 1/0, "true"/"false",
"1"/"0", "yes"/"no", "on"/"off" (case-insensitive). Anything else
is a 400 naming the option instead of a silent truthy fallback.
3. customSymbols is validated: at most 64 code points, duplicates dropped,
control characters and whitespace rejected with a 400.
4. Random mode entropy with requireEach now counts only the passwords that
contain a character of every enabled class (inclusion-exclusion). The
value is an upper bound and is labelled as such in the API
(entropyApproximate/entropyNote) and in the UI.
5. docker-compose.yml uses expose instead of ports, so it no longer
collides with Dokploy's own port 3000.
6. SIGTERM/SIGINT shut the server down gracefully: close the listener, let
in-flight requests finish, force-exit after 5s. Measured at ~60ms.
The server now exports createServer() so the API can be tested over HTTP
without binding a fixed port.
Public password generator with no auth and no npm dependencies.
- Server-side generation using crypto.randomInt; two levels: diceware-style
memorable passphrases (42abacus-91abdomen) and fully random characters.
- Configurable word list (EFF Large / EFF Short), digits per word, separators,
capitalization, length, character class toggles, custom symbols and
ambiguous-character exclusion.
- Light/dark theme matching druid520/site, entropy estimate and strength bar,
clipboard copy, options persisted in localStorage.
- Dockerfile for Dokploy plus a Woodpecker deploy hook on trunk.
reze