Starpass Generator is a not-for-profit, open-source web application that generates secure passwords, passphrases, and usernames — entirely in your browser. Built on a zero-knowledge architecture, Starpass never collects, stores, or transmits your data. It works offline as a Progressive Web App (PWA) and is licensed under the GNU General Public License Version 3 (GPLv3).
Starpass uses the zxcvbn library for password strength assessment and a structured local word dataset (src/common_wordslist.json) for passphrase and username generation. The dataset is organized by word length and semantic roles (adjectives, nouns, verbs) to produce readable, high-quality output.
Beta notice: Starpass is actively developed. Some features are still in progress — expect occasional rough edges and check the Roadmap for what's coming.
- Features
- Installation
- Usage
- Privacy and Data Handling
- Technical Details
- Security
- Contributing
- Community
- Roadmap
- License
- Support
- Acknowledgments
| Feature | Description |
|---|---|
| 🔑 Password Generator | Adjustable length, character sets (lower, upper, numbers, symbols), and optional ambiguous-character exclusion |
| 🗣️ Passphrase Generator | Role-based word combinations, customisable word count, separator choice, capitalisation, and number/symbol appending |
| 👤 Username Generator | Length-aware, role-templated combinations (e.g. adjective+noun) with case and number options |
| 🛡️ Strength Analysis | Real-time zxcvbn scoring (0–4) with crack-time estimate and improvement suggestions |
| 🔒 Zero-Knowledge | All processing happens locally — no cookies, no trackers, no analytics, no server calls |
| 📱 PWA / Offline | Install from Chrome or Edge for full offline access |
| ♿ Accessibility | Standard and high-contrast themes; keyboard-navigable interface |
| 📋 Clipboard Copy | One-click copy with visual confirmation |
Starpass is a pure browser app — no build step required.
Visit https://starpass.samin-yasar.dev — no account or installation needed.
- Open Starpass in Chrome or Edge.
- Click the Install icon in the address bar (or choose "Add to Home Screen" on mobile).
- Launch Starpass any time from your app menu or home screen, fully offline.
# 1. Clone the repository
git clone https://github.com/Samin-yasar/Starpass.git
cd Starpass
# 2. Serve with any static file server
python -m http.server 8000
# or: npx serve .
# 3. Open in your browser
open http://localhost:8000Note:
zxcvbnis already bundled atsrc/zxcvbn.min.js— nonpm installis required to run the app. If you want to update the library, runnpm install zxcvbnand replace the bundled file.
- Open the Password tab.
- Set the desired length (default: 16) and select character types.
- Optionally enable Exclude Ambiguous Characters to avoid look-alike characters like
l,I,0,O. - Click Generate Password.
- Open the Passphrase tab.
- Choose word count and separator (hyphen, dot, underscore, space, or none).
- Optionally enable capitalisation or append a number/symbol.
- Click Generate Passphrase.
- Open the Username tab.
- Set target length and choose a role template.
- Optionally force lowercase or append a number.
- Click Generate Username.
- Click the Copy to Clipboard button next to any result.
- The strength meter beneath each result shows the zxcvbn score and estimated crack time.
Use the theme toggle in the top-right corner to switch between standard and high-contrast modes.
Starpass is built around one core principle: your credentials never leave your device.
- ✅ All generation and processing happen locally in your browser.
- ✅ No personal data (credentials, IP address, browser fingerprint) is collected, stored, or transmitted.
- ✅ No cookies, trackers, or analytics are used.
- ✅ The app works fully offline — it never needs a network connection after the initial load.
- ✅ Support requests sent via email are the only case where you voluntarily share data, and that data is retained minimally.
For full details, see the Privacy Notice.
Starpass integrates zxcvbn (MIT-licensed, by Dropbox) for realistic strength estimation. zxcvbn evaluates passwords against common patterns — dictionary words, keyboard sequences, date formats, repetitions — and returns a score from 0 (very weak) to 4 (very strong) along with estimated crack time and actionable suggestions.
src/common_wordslist.json is organised into multiple layers:
- Length buckets — words grouped by character count (3 through 11 characters) for length-aware generation.
- Semantic categories — adjectives, nouns, verbs, and connectors for meaningful word combinations.
- Role templates — pre-defined patterns (e.g.
adjective+noun,noun+verb+noun) that produce coherent passphrases and readable usernames.
All credential generation uses crypto.getRandomValues() (the Web Cryptography API) — never Math.random(). This ensures cryptographically secure randomness in all modern browsers.
Security is a first-class concern in Starpass. If you discover a vulnerability, please do not open a public GitHub issue — that could put users at risk before a fix is ready.
Instead, please report privately:
- 🔒 GitHub Private Security Advisory (preferred)
- 📧 contact@samin-yasar.dev with subject
[STARPASS SECURITY] …
Read the full disclosure process, scope, and response timeline in SECURITY.md.
Starpass is open-source and community-driven — contributions of all kinds are welcome.
- 🐛 Found a bug? → Open a Bug Report
- 💡 Have a feature idea? → Submit a Feature Request
- 📖 Spotted a docs issue? → Report a Documentation Issue
- ✨ Want to write code? → Read CONTRIBUTING.md for the full workflow, branch conventions, style guide, and PR checklist.
Quick start for contributors:
git clone https://github.com/YOUR_USERNAME/Starpass.git
cd Starpass
python -m http.server 8000 # no build step neededAll contributions must be compatible with GPLv3. Please use crypto.getRandomValues() for any security-sensitive randomness — never Math.random().
We are committed to building an open, welcoming, and harassment-free community.
| Document | Purpose |
|---|---|
| CODE_OF_CONDUCT.md | Standards for participation and enforcement process |
| CONTRIBUTING.md | How to contribute code, docs, and ideas |
| SECURITY.md | How to responsibly disclose security vulnerabilities |
| SUPPORT.md | Where to get help and expected response times |
When you open a new issue or pull request on GitHub, you'll be guided by structured forms that ensure clear, actionable reports:
- Bug Report — prompts for affected feature, steps to reproduce, browser, OS, and console errors.
- Feature Request — frames requests around problems before solutions, with priority level.
- Documentation Issue — file location picker and issue type dropdown.
- Pull Request — type-of-change checklist, testing steps, browser matrix, security checklist, and breaking-change declaration.
Blank issues are disabled — every report follows a template, so nothing important gets missed.
- Complete real-time strength analysis display (zxcvbn integration).
- Implement Save to History with local, encrypted storage.
- Add integration with StarryCrypt.
- Enhance PWA stability and cross-browser compatibility.
- Expand accessibility options (ARIA, keyboard navigation, screen reader support).
- Internationalisation (i18n) support.
Starpass Generator is licensed under the GNU General Public License Version 3 (GPLv3). You are free to use, modify, and distribute the code, provided that any derivative work is also distributed under GPLv3 with its source code available.
The bundled zxcvbn library is MIT-licensed by Dropbox, Inc.
| I need help with… | Go to… |
|---|---|
| A bug or broken feature | GitHub Issues → Bug Report |
| A feature suggestion | GitHub Issues → Feature Request |
| A security vulnerability | SECURITY.md — report privately |
| General questions | contact@samin-yasar.dev or samin-yasar.dev/#contact |
For full details and expected response times, see SUPPORT.md.
Developed by Samin Yasar as a community-driven, not-for-profit project.
Special thanks to:
- Dropbox — for the zxcvbn password strength library (MIT licence).
- Electronic Frontier Foundation (EFF) — for the Long Wordlist that informed our word dataset.
- All contributors and the broader open-source community for supporting privacy-respecting tools.
Made with ❤️ for a more private internet.