JPKCom DB

Generator — Manual

Full feature reference for the Generator: all six tabs, options and character sets, passphrases, Wi-Fi QR, .htpasswd, TOTP, and the text API.

Back to the overview: Generator · Open the tool live: www.jpkc.com/tools/generator/

This manual documents the Generator in full: each of the six tabs, its options and character sets, the architecture, the text API for scripts, and the limits that apply. The interface is in English, so the tab and button names below match what you see in the tool.

Architecture and privacy first

  • Everything on the page is generated in the browser. Random values come from crypto.getRandomValues; to give every character exactly the same probability, the tool discards random numbers above the largest multiple of the alphabet size (rejection sampling, no modulo bias). The hashes in the .htpasswd tab are computed locally by the WebAssembly library hash-wasm, TOTP codes by the Web Crypto API (HMAC). There are no AJAX calls, no storage, and no history.
  • One source for the character sets. The alphabets are defined server-side as a PHP constant and handed to the JavaScript on page load, so the page and the text API generate from identical sets. All of them are printable ASCII without ' and \ — no §, which is missing from non-German keyboards, and no spaces, which tend to get lost at the edges when you copy a value.
  • The only thing loaded on demand is the word list for passphrases (EFF Large Wordlist, 7,776 words, licensed CC BY 3.0 US), and only once you select that mode.

In practice: a password you type in for a .htpasswd line and a TOTP secret never leave your machine. The result fields are editable; Copy puts their current content on the clipboard.

Passwords — password generator

The default tab produces random passwords and passphrases. The controls:

  • Complexity (character set or method):
    • a-z + A-Z + 0-9 + more specials (default) — 79 characters: letters, digits, and , . - ; _ # + * ! $ % & / ( ) = ?.
    • a-z + A-Z + 0-9 + less specials — 72 characters, with only . - _ + # $ % * , ! as specials, for systems that balk at some characters.
    • a-z + A-Z + 0-9 — 62 characters, alphanumeric only.
    • a-f + 0-9 (hex) — 16 characters, for tokens and keys.
    • Apple-style (memorable, pronounceable) — see Apple-style.
    • Passphrase (words from the EFF list) — see Passphrases.
  • Length: a number field from 4 to 128, default 24. Values outside that range are snapped to the nearest limit when you generate; an empty field (or 0) falls back to the default of 24.
  • How many: 1 (default), 5, 10, or 20 results at once, one per line.
  • Exclude look-alikes (switch, off): removes the easily confused characters 0 O o 1 l I | from the set — handy when someone has to type the password or read it aloud. The set shrinks accordingly (from 79 to 73 characters, for example). The switch is hidden for hex, Apple-style, and passphrases. Hidden doesn't mean off, though: if you turned it on in another tier earlier, it keeps removing 0 and 1 in hex mode — the set shrinks to 14 characters and the entropy readout drops accordingly. Turn it off before switching to hex.

Generate Password creates new values, Copy copies the result field.

Entropy readout: next to the buttons, a badge shows the strength as estimated entropy in bits ("≈ N bits of entropy"). For random passwords the tool computes length × log₂(size of the character set). The levels: below 40 bits weak, below 60 fair, below 80 strong, from 80 very strong. A 24-character password from the full set comes to about 151 bits.

Apple-style — pronounceable and memorable

Pick Apple-style and the Length field gives way to Blocks: 3 (default) to 9 blocks of six characters separated by - — that's 20 to 62 characters. Each block alternates consonant and vowel, which makes it pronounceable. Only the consonants bcdfghjkmnpqrstvwxz and the vowels aeiuy are used; l and o are left out on purpose. Across the whole password, exactly one digit (2 to 9) replaces a consonant and exactly one letter is uppercase. A result looks like kibavu-se4iru-Nypuky. According to the readout, three blocks give about 69 bits, four blocks about 90 bits.

Passphrases — words from the EFF list

With Passphrase (words from the EFF list) the tool strings together words from the EFF Large Wordlist. Each word contributes log₂(7,776) ≈ 12.9 bits. The options:

  • Words: 3 to 12 words, default 6.
  • Separator (the dropdown next to the word count): - (default), space, ., or _.
  • Capitalize words (off): capitalizes every word.
  • Add a digit (on): appends a digit from 0 to 9 to one randomly chosen word — for login forms that insist on a number.

Six words plus a digit come to about 83 bits on the readout, for example pellet-unbiased-cubicle7-snore-quarry-dwelling (example). If the word list can't be loaded, the tool reports "Could not load the word list."

Salt — salt keys

Generates cryptographic salt keys from the tool's largest character set: 91 characters, namely letters, digits, and , . - ; : _ # + * ! $ % & / ( ) = ? ` ^ < > @ [ ] | { } ~. Spaces are no longer part of it.

  • Length: 16, 32, 64 (default), 128, 256, 512, 1024.

Generate Salt Key produces a value. Suitable for general secret and salt values in configurations.

WordPress — security keys for wp-config.php

Generates the eight WordPress security keys: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, and NONCE_SALT. The character set has 90 characters — the same as for salts, minus $.

  • Key Length: 64 (default), 72, 96, 128.
  • Format:
    • wp-config.php (define) (default) — eight ready-made lines like define('AUTH_KEY', '…');.
    • .env (Bedrock / Roots) — eight lines in the form NAME='…', for setups that read the keys from a .env file. The names are padded with spaces to 16 characters for alignment, e.g. AUTH_KEY ='…'.

Because the character set contains neither ' nor \, no key can break out of the single quotes — in PHP or in the .env. Generate Keys delivers the block, Copy copies it.

Extreme Keys — hardened keys with hash_hmac()

The Extreme Keys button (yellow) first reveals an options panel; another click while the panel is open generates. This mode builds the keys not statically but as PHP code that derives them at runtime via hash_hmac('sha512', …) from static secrets and dynamic server variables. Options:

  • Key Rotation: No rotation (recommended) (default), Hourly, Daily, Weekly, Monthly — how often the keys change automatically via date().
  • Dynamic Components (switches): Client IP (REMOTE_ADDR, off), User-Agent (HTTP_USER_AGENT, off), Server Address (SERVER_ADDR + SERVER_NAME, on).

The generated code contains eight static secrets (JPKCOM_EX_SECRET_1 to _8, length per Key Length), the helper function jpkcom_extreme_key(), and the eight define() lines; a comment header lists the chosen components and the situations in which sessions become invalid. The output is always PHP — the Format setting doesn't apply here. With every component off and no rotation, what remains is a purely static hash_hmac().

Important: any selected component that changes invalidates active sessions. The warning in the panel spells out the consequences: the client IP is unreliable behind CDNs and proxies and logs mobile users out on every network switch, a browser update changes the User-Agent, and every rotation logs everyone out and breaks password-reset links. According to the tool, the defaults (server address only, no rotation) are the safe choice.

WLAN — WPA/WPA2 keys

Generates Wi-Fi keys of 20 to 63 characters.

  • Complexity: a-z + A-Z + 0-9 + specials (default; 67 characters including . - _ , +) or a-z + A-Z + 0-9 (alphanumeric only).
  • Length: 20, 30, 40, 50, 63 (default).

Generate WLAN Key produces the key, Copy copies it.

Wi-Fi QR code

Below the key, the tool can build a QR code that phones scan to join the network without typing anything:

  • Network name (SSID) — the name of your Wi-Fi network.
  • Security: WPA / WPA2 (default) or WPA3 (SAE).
  • Hidden network (switch) — for networks that don't broadcast their SSID.

The QR code appears as soon as an SSID and a key are filled in, and it is redrawn whenever you change the SSID, Security, Hidden setting, or key. The result field is editable — you can also enter an existing key there. The QR code contains the standard string WIFI:T:WPA;S:<SSID>;P:<key>;; (with T:SAE for WPA3, plus H:true; for a hidden network); the characters \ ; , : " in the SSID and key are escaped. Save QR Code saves it as wifi-qr.png.

.htpasswd — a user line with bcrypt or APR1-MD5

Creates a finished user:hash line for a .htpasswd file, which Apache or nginx use to protect a directory with Basic Auth. The computation happens in the browser.

  • Username: default admin; spaces and colons aren't allowed.
  • Algorithm:
    • bcrypt (recommended, htpasswd -B) (default) — with a random 16-byte salt; the prefix is set to $2y$, the way htpasswd -B writes it.
    • APR1-MD5 (legacy, htpasswd -m) — Apache's own MD5 scheme ($apr1$, 8-character salt, 1,000 MD5 rounds).
  • bcrypt cost: 5, 8, 10 (default), 12, 14 — the work factor (higher = slower). Hidden when APR1 is selected.
  • Password: your own password, or Generate fills in a 24-character one from the less specials set.

Create .htpasswd line writes the result, e.g. admin:$2y$10$…; Copy line copies it. If the password is longer than 72 bytes, the tool warns you that bcrypt only uses the first 72 bytes.

The note below the result lists the requirements: bcrypt needs Apache 2.4 or an nginx whose system crypt() supports bcrypt (libxcrypt, current distributions). APR1-MD5 works everywhere but is weak.

Password hashes — now in the Hash tool

The former Hashes tab (BCrypt, Argon2i, Argon2id) is gone from the Generator. Password hashes for applications — bcrypt, Argon2id, and PBKDF2, each with verification of an existing hash — now live in the Hash Generator; its manual covers them under Password hashing. The "Hash tool" link in the .htpasswd tab opens the password-hashing section there directly. Neither tool offers Argon2i any more.

OTP — TOTP one-time codes (RFC 6238)

Sets up time-based two-factor authentication (TOTP) — entirely in the browser via the Web Crypto API. Works with common authenticator apps (Google Authenticator, Aegis, and others).

Inputs and fields:

  • Account Name and Issuer (the service name) — go into the label of the key URL and the QR code. Defaults: user@example.com and My Service; an empty field falls back to the default.
  • Secret (Base32) — the secret key material. A 20-byte secret is already filled in on page load. Generate creates a new one whose length matches the selected algorithm: 20 bytes for SHA-1, 32 bytes for SHA-256, 64 bytes for SHA-512. You can also paste an existing secret; the tool uppercases it and strips everything except A–Z and 2–7, spaces and = included. The clipboard button next to it copies it. Codes, QR, and URL require a secret of at least 16 characters.
  • Secret (Hex) — a read-only hex representation of the same secret.
  • Interval — a code's lifetime: 30 seconds (default) or 60 seconds.
  • Digits — 6 (default) or 8.
  • Algorithm — SHA-1 (all apps) (default), SHA-256, or SHA-512. The hint below warns that many apps (Google Authenticator, for instance) only support SHA-1 with six digits; change either only if your service requires it. When you switch algorithms, the tool keeps the existing secret; click Generate afterwards to get one of matching length.
  • Check a code (from your app) — type the code from your authenticator app here. The tool checks it against the current time window plus one window before and after and reports ✓ valid now, ✓ valid (previous window), ✓ valid (next window), or ✗ not valid.
  • Key URL (otpauth://) — the finished URL otpauth://totp/<Issuer>:<Account>?secret=…&issuer=…&algorithm=…&digits=…&period=… (label URL-encoded) with your chosen values. Copy and Open buttons (Open launches the URL in a new browser window).
  • QR code — rendered from the key URL (196 × 196 px, error-correction level M) as dark modules on a white background with a quiet zone, so scanners and authenticator apps can read it. Save QR Code downloads it as otp-qr.png with an extra white border.

Live display: three codes side by side — Previous, Current OTP (with its own copy button), and Next — plus info cards for Epoch (UTC), Iteration (T), Padded Hex (the counter as a 16-digit hex value), and Remaining (seconds left), and a progress bar that turns yellow at ≤ 10 s and red at ≤ 5 s. The display refreshes every second.

Text API for scripts

For shell scripts and automation, the Generator answers simple GET requests with plain text (text/plain, with no-cache headers). Here the server generates the values (PHP random_int(), random_bytes() for hex), using the same character sets as the page. The number at the end is the length:

Endpoint Result Allowed length
pw/<n>/ password, more specials 1–64
pwl/<n>/ password, less specials 1–64
pws/<n>/ password, alphanumeric 1–64
pwvs/<n>/ hex string 1–64
salt/<n>/ salt key 1–1024
wp/<n>/ eight WordPress keys as define() 1–128
wpx/<n>/ Extreme Keys 1–128
wlan/<n>/ Wi-Fi key with specials 20–63
wlana/<n>/ Wi-Fi key, alphanumeric 20–63
apw/<n>/, apwl/<n>/, apws/<n>/, apwvs/<n>/ password (character set as pw … pwvs) plus APR1-MD5 hash 1–64 
curl -s https://www.jpkc.com/tools/generator/pw/32/
curl -s "https://www.jpkc.com/tools/generator/wpx/64/?rotation=none&ip=0&ua=0&server=1"

wpx takes the parameters rotation (none, hourly, daily, weekly, monthly) plus ip, ua, and server (1 = on, 0 = off). Without parameters the API uses the same safe defaults as the interface: no rotation (none), server address only (ip=0, ua=0, server=1). Rotation, Client IP, and User-Agent are opt-in. The apw* endpoints respond with two blocks, Password: and APR1-MD5:.

If the length is out of range, you get the regular HTML page back instead of text. Each IP address may send 120 requests per 60 seconds; beyond that the server answers with HTTP 429 and a Retry-After header.

Limits — at a glance

  • Passwords (page): 4–128 characters, up to 20 at once; Apple-style 3–9 blocks (20–62 characters); passphrases 3–12 words.
  • Salt keys: 16 to 1024 characters.
  • WLAN keys: 20 to 63 characters; Wi-Fi QR for WPA/WPA2 or WPA3 (SAE).
  • WordPress keys: eight keys; length 64/72/96/128; wp-config.php or .env.
  • .htpasswd: bcrypt (cost 5–14, $2y$, uses at most 72 bytes of the password) or APR1-MD5.
  • TOTP: SHA-1/-256/-512, 6 or 8 digits, period 30 or 60 s; secret 20/32/64 bytes (Base32), codes and QR from a 16-character secret upward; code check ±1 time window.
  • Text API: passwords 1–64, salt 1–1024, WordPress 1–128, Wi-Fi 20–63; 120 requests per minute and IP.
  • Privacy: on the page everything is generated in the browser; only the text API generates server-side, with no-cache.

For the audience and the big picture, see the overview. Concrete workflows are in the examples, strategy and pitfalls in the tips & tricks. You can try everything directly in the tool.