Generate, compare, entropy
Make a secret, check one without leaking timing, and measure how random something actually looks.
Note
ELI5. Three small tools that show up together. secureGenerate invents a password or token from real randomness instead of Math.random(). secureCompare checks a submitted secret against the real one in a way that takes the same time whether the first character is wrong or the last, so an attacker cannot feel their way to the answer one character at a time. entropy measures how varied a string looks, which is a useful heuristic for rejecting obvious junk and is not a security guarantee.
secureGenerate()
Passwords, tokens and PINs from a CSPRNG, with per-category guarantees.
secureCompare()
Constant-time comparison that treats untrusted input as a mismatch, not an error.
entropy()
Shannon entropy, bigram entropy and monotonic-run detection.
#How they fit together
import { secureGenerate } from "unsecure/generate";
import { secureCompare } from "unsecure/compare";
import { entropy } from "unsecure/entropy";
// Make it
const token = secureGenerate({ length: 32, specials: false });
// Sanity-check something a user chose
const { bits, longestRun } = entropy(userSupplied);
if (bits < 60 || longestRun >= 5) reject();
// Check it, later, without leaking where it differs
if (!secureCompare(stored, submitted)) return unauthorized();entropy() is a quality gate on human input. secureCompare() is a safety property of the check itself. secureGenerate() is how you avoid needing the first one at all.