strong_password

A Dart/Flutter package that generates very strong, Gmail-style random passwords, along with memorable passphrases, numeric PINs, a password strength estimator, and a deterministic per-service password generator.

Inspired by the strong password Gmail suggests when you create a new account: a random mix of upper/lowercase letters, digits and symbols using cryptographically secure randomness.

Features

• 🔐 Deterministic "password-by-service" generator — one master secret, a unique strong password for every site, nothing stored.
• 🔒 Crypto-secure RNG (Random.secure) — no weak Random().
• 🔑 Random strong passwords (default 16 chars) like Tn7!qwLm@4pKzE9.
• ⚙️ Fully configurable: length, character groups, ambiguous characters, and at-least-one guarantees per group.
• 🧠 Passphrase generator (correct-horse-battery-staple style).
• 🔢 PIN generator and a bulk generator (many unique passwords at once).
• 📊 Strength + crack-time estimator for existing passwords.
• 🧭 Curated profiles for standard / high / paranoid / PIN.
• 🛡️ HMAC-SHA256 for deterministic passwords, via the Dart-team crypto package (the same construction password managers use).

Installation

dart pub add strong_password
# or, in a Flutter project:
flutter pub add strong_password

Usage

Generate a strong password (Gmail style)

import 'package:strong_password/strong_password.dart';

void main() {
  final generator = StrongPasswordGenerator();

  // Default: 16 chars, mixed case + digits + symbols.
  final password = generator.generate();
  print(password); // e.g. "Tn7!qwLm@4pKzE9"

  // Customize the length.
  final longer = generator.generate(const PasswordOptions(length: 20));

  // Exclude confusing characters (0/O, 1/l, ...).
  final readable = generator.generate(
    const PasswordOptions(length: 18, excludeAmbiguous: true),
  );
}

Passphrase (memorable)

final pass = PassphraseGenerator().generate();
print(pass); // e.g. "silver-harbor-ember-tiger7"

Deterministic password per service (the differentiator)

Derive a unique, strong password for every website from a single master secret, without storing any of them. Same inputs → same password; change the service name → different password.

final gen = DeterministicPasswordGenerator();
final gmail = gen.generate(secret: 'my-master-secret', service: 'gmail.com');
final github = gen.generate(secret: 'my-master-secret', service: 'github.com');
// gmail != github, and both are reproducible on any device.

Change version to invalidate all previously derived passwords after a leak.

PIN

final pin = PinGenerator().generate();          // 6 digits
final atm = PinGenerator().generate(length: 4, allowLeadingZero: false);

Bulk generation

final many = StrongPasswordGenerator().generateMany(5); // 5 unique passwords

Curated profiles

final options = PasswordProfiles.options(PasswordProfiles.paranoid);
final ultra = StrongPasswordGenerator().generate(options);

Check an existing password's strength

final s = estimatePasswordStrength(password);
print('entropy: ${s.entropyBits} bits'); // e.g. 100
print('score: ${s.score}');              // e.g. 95
print('label: ${s.strength}');           // Strength.strong
print('cracked?: ${s.isCracked}');       // false
print('crack time: ${s.crackTimeLabel()}'); // e.g. "~12 years"

API

Class / function	Purpose
StrongPasswordGenerator.generate()	Gmail-style strong passwords
StrongPasswordGenerator.generateMany()	Bulk / unique passwords
PasswordOptions	Tuning for the generator
DeterministicPasswordGenerator	Per-service passwords from one secret
PasswordProfiles	Curated one-line configs (standard/high/paranoid/pin)
GeneratedPassword	Password + options bundle
PassphraseGenerator	Memorable passphrases
PinGenerator	Numeric PINs
estimatePasswordStrength()	Weak / fair / good / strong check
PasswordStrength.crackTimeLabel()	Human-readable crack-time estimate
PasswordStrength, Strength	Result types
buildAlphabet, StringGroups	Build custom alphabets

Features

Gmail-style strong passwords

StrongPasswordGenerator produces a random string and guarantees at least one lowercase, one uppercase and one digit (configurable), so the result always passes common password policies — just like Google's suggestion.

Cryptographically secure entropy

All randomness comes from Random.secure(), which on every supported platform uses the operating system's CSPRNG. No shipped Random seeded values, so the output is not predictable.

License

MIT — see LICENSE.