@depup/crypto-random-string 5.0.0-depup.0

package/README.md

@@ -0,0 +1,31 @@
+# @depup/crypto-random-string
+
+> Dependency-bumped version of [crypto-random-string](https://www.npmjs.com/package/crypto-random-string)
+
+Generated by [DepUp](https://github.com/depup/npm) -- all production
+dependencies bumped to latest versions.
+
+## Installation
+
+```bash
+npm install @depup/crypto-random-string
+```
+
+| Field | Value |
+|-------|-------|
+| Original | [crypto-random-string](https://www.npmjs.com/package/crypto-random-string) @ 5.0.0 |
+| Processed | 2026-03-17 |
+| Smoke test | passed |
+| Deps updated | 1 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| type-fest | ^2.12.2 | ^5.4.4 |
+
+---
+
+Source: https://github.com/depup/npm | Original: https://www.npmjs.com/package/crypto-random-string
+
+License inherited from the original package.

package/browser.js

@@ -0,0 +1,31 @@
+/* eslint-env browser */
+import {createStringGenerator, createAsyncStringGenerator} from './core.js';
+
+const toHex = uInt8Array => [...uInt8Array].map(byte => byte.toString(16).padStart(2, '0')).join('');
+const toBase64 = uInt8Array => btoa(String.fromCodePoint(...uInt8Array));
+
+// `crypto.getRandomValues` throws an error if too much entropy is requested at once. (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues#exceptions)
+const maxEntropy = 65_536;
+
+function getRandomValues(byteLength) {
+	const generatedBytes = new Uint8Array(byteLength);
+
+	for (let totalGeneratedBytes = 0; totalGeneratedBytes < byteLength; totalGeneratedBytes += maxEntropy) {
+		generatedBytes.set(
+			crypto.getRandomValues(new Uint8Array(Math.min(maxEntropy, byteLength - totalGeneratedBytes))),
+			totalGeneratedBytes,
+		);
+	}
+
+	return generatedBytes;
+}
+
+function specialRandomBytes(byteLength, type, length) {
+	const generatedBytes = getRandomValues(byteLength);
+	const convert = type === 'hex' ? toHex : toBase64;
+
+	return convert(generatedBytes).slice(0, length);
+}
+
+export default createStringGenerator(specialRandomBytes, getRandomValues);
+export const cryptoRandomStringAsync = createAsyncStringGenerator(specialRandomBytes, getRandomValues);

package/changes.json

@@ -0,0 +1,10 @@
+{
+  "bumped": {
+    "type-fest": {
+      "from": "^2.12.2",
+      "to": "^5.4.4"
+    }
+  },
+  "timestamp": "2026-03-17T16:35:04.736Z",
+  "totalUpdated": 1
+}

package/core.js

@@ -0,0 +1,140 @@
+const urlSafeCharacters = [...'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'];
+const numericCharacters = [...'0123456789'];
+const distinguishableCharacters = [...'CDEHKMPRTUWXY012458'];
+const asciiPrintableCharacters = [...'!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~'];
+const alphanumericCharacters = [...'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'];
+
+const readUInt16LE = (uInt8Array, offset) => uInt8Array[offset] + (uInt8Array[offset + 1] << 8); // eslint-disable-line no-bitwise
+
+const generateForCustomCharacters = (length, characters, randomBytes) => {
+	// Generating entropy is faster than complex math operations, so we use the simplest way
+	const characterCount = characters.length;
+	const maxValidSelector = (Math.floor(0x1_00_00 / characterCount) * characterCount) - 1; // Using values above this will ruin distribution when using modular division
+	const entropyLength = 2 * Math.ceil(1.1 * length); // Generating a bit more than required so chances we need more than one pass will be really low
+	let string = '';
+	let stringLength = 0;
+
+	while (stringLength < length) { // In case we had many bad values, which may happen for character sets of size above 0x8000 but close to it
+		const entropy = randomBytes(entropyLength);
+		let entropyPosition = 0;
+
+		while (entropyPosition < entropyLength && stringLength < length) {
+			const entropyValue = readUInt16LE(entropy, entropyPosition);
+			entropyPosition += 2;
+			if (entropyValue > maxValidSelector) { // Skip values which will ruin distribution when using modular division
+				continue;
+			}
+
+			string += characters[entropyValue % characterCount];
+			stringLength++;
+		}
+	}
+
+	return string;
+};
+
+const generateForCustomCharactersAsync = async (length, characters, randomBytesAsync) => {
+	// Generating entropy is faster than complex math operations, so we use the simplest way
+	const characterCount = characters.length;
+	const maxValidSelector = (Math.floor(0x1_00_00 / characterCount) * characterCount) - 1; // Using values above this will ruin distribution when using modular division
+	const entropyLength = 2 * Math.ceil(1.1 * length); // Generating a bit more than required so chances we need more than one pass will be really low
+	let string = '';
+	let stringLength = 0;
+
+	while (stringLength < length) { // In case we had many bad values, which may happen for character sets of size above 0x8000 but close to it
+		const entropy = await randomBytesAsync(entropyLength); // eslint-disable-line no-await-in-loop
+		let entropyPosition = 0;
+
+		while (entropyPosition < entropyLength && stringLength < length) {
+			const entropyValue = readUInt16LE(entropy, entropyPosition);
+			entropyPosition += 2;
+			if (entropyValue > maxValidSelector) { // Skip values which will ruin distribution when using modular division
+				continue;
+			}
+
+			string += characters[entropyValue % characterCount];
+			stringLength++;
+		}
+	}
+
+	return string;
+};
+
+const allowedTypes = new Set([
+	undefined,
+	'hex',
+	'base64',
+	'url-safe',
+	'numeric',
+	'distinguishable',
+	'ascii-printable',
+	'alphanumeric',
+]);
+
+const createGenerator = (generateForCustomCharacters, specialRandomBytes, randomBytes) => ({length, type, characters}) => {
+	if (!(length >= 0 && Number.isFinite(length))) {
+		throw new TypeError('Expected a `length` to be a non-negative finite number');
+	}
+
+	if (type !== undefined && characters !== undefined) {
+		throw new TypeError('Expected either `type` or `characters`');
+	}
+
+	if (characters !== undefined && typeof characters !== 'string') {
+		throw new TypeError('Expected `characters` to be string');
+	}
+
+	if (!allowedTypes.has(type)) {
+		throw new TypeError(`Unknown type: ${type}`);
+	}
+
+	if (type === undefined && characters === undefined) {
+		type = 'hex';
+	}
+
+	if (type === 'hex' || (type === undefined && characters === undefined)) {
+		return specialRandomBytes(Math.ceil(length * 0.5), 'hex', length); // Needs 0.5 bytes of entropy per character
+	}
+
+	if (type === 'base64') {
+		return specialRandomBytes(Math.ceil(length * 0.75), 'base64', length); // Needs 0.75 bytes of entropy per character
+	}
+
+	if (type === 'url-safe') {
+		return generateForCustomCharacters(length, urlSafeCharacters, randomBytes);
+	}
+
+	if (type === 'numeric') {
+		return generateForCustomCharacters(length, numericCharacters, randomBytes);
+	}
+
+	if (type === 'distinguishable') {
+		return generateForCustomCharacters(length, distinguishableCharacters, randomBytes);
+	}
+
+	if (type === 'ascii-printable') {
+		return generateForCustomCharacters(length, asciiPrintableCharacters, randomBytes);
+	}
+
+	if (type === 'alphanumeric') {
+		return generateForCustomCharacters(length, alphanumericCharacters, randomBytes);
+	}
+
+	if (characters.length === 0) {
+		throw new TypeError('Expected `characters` string length to be greater than or equal to 1');
+	}
+
+	if (characters.length > 0x1_00_00) {
+		throw new TypeError('Expected `characters` string length to be less or equal to 65536');
+	}
+
+	return generateForCustomCharacters(length, characters, randomBytes);
+};
+
+export function createStringGenerator(specialRandomBytes, randomBytes) {
+	return createGenerator(generateForCustomCharacters, specialRandomBytes, randomBytes);
+}
+
+export function createAsyncStringGenerator(specialRandomBytesAsync, randomBytesAsync) {
+	return createGenerator(generateForCustomCharactersAsync, specialRandomBytesAsync, randomBytesAsync);
+}

package/index.d.ts

@@ -0,0 +1,105 @@
+import {MergeExclusive} from 'type-fest';
+
+interface BaseOptions {
+	/**
+	Length of the returned string.
+	*/
+	length: number;
+}
+
+interface TypeOption {
+	/**
+	Use only characters from a predefined set of allowed characters.
+
+	Cannot be set at the same time as the `characters` option.
+
+	@default 'hex'
+
+	The `distinguishable` set contains only uppercase characters that are not easily confused: `CDEHKMPRTUWXY012458`. It can be useful if you need to print out a short string that you'd like users to read and type back in with minimal errors. For example, reading a code off of a screen that needs to be typed into a phone to connect two devices.
+
+	The `ascii-printable` set contains all [printable ASCII characters](https://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters): ``!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~`` Useful for generating passwords where all possible ASCII characters should be used.
+
+	The `alphanumeric` set contains uppercase letters, lowercase letters, and digits: `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789`. Useful for generating [nonce](https://developer.mozilla.org/en-US/docs/Web/API/HTMLOrForeignElement/nonce) values.
+
+	@example
+	```
+	cryptoRandomString({length: 10});
+	//=> '87fc70e2b9'
+
+	cryptoRandomString({length: 10, type: 'base64'});
+	//=> 'mhsX7xmIv/'
+
+	cryptoRandomString({length: 10, type: 'url-safe'});
+	//=> 'VEjfNW3Yej'
+
+	cryptoRandomString({length: 10, type: 'numeric'});
+	//=> '8314659141'
+
+	cryptoRandomString({length: 6, type: 'distinguishable'});
+	//=> 'CDEHKM'
+
+	cryptoRandomString({length: 10, type: 'ascii-printable'});
+	//=> '`#Rt8$IK>B'
+
+	cryptoRandomString({length: 10, type: 'alphanumeric'});
+	//=> 'DMuKL8YtE7'
+	```
+	*/
+	type?: 'hex' | 'base64' | 'url-safe' | 'numeric' | 'distinguishable' | 'ascii-printable' | 'alphanumeric';
+}
+
+interface CharactersOption {
+	/**
+	Use only characters from a custom set of allowed characters.
+
+	Cannot be set at the same time as the `type` option.
+
+	Minimum length: `1`
+	Maximum length: `65536`
+
+	@example
+	```
+	cryptoRandomString({length: 10, characters: '0123456789'});
+	//=> '8796225811'
+	```
+	*/
+	characters?: string;
+}
+
+export type Options = BaseOptions & MergeExclusive<TypeOption, CharactersOption>;
+
+/**
+Generate a [cryptographically strong](https://en.wikipedia.org/wiki/Strong_cryptography) random string.
+
+@returns A randomized string.
+
+@example
+```
+import cryptoRandomString from 'crypto-random-string';
+
+cryptoRandomString({length: 10});
+//=> '2cf05d94db'
+```
+*/
+export default function cryptoRandomString(options: Options): string;
+
+/**
+Asynchronously generate a [cryptographically strong](https://en.wikipedia.org/wiki/Strong_cryptography) random string.
+
+For most use-cases, there's really no good reason to use this async version. From the Node.js docs:
+
+> The `crypto.randomBytes()` method will not complete until there is sufficient entropy available. This should normally never take longer than a few milliseconds. The only time when generating the random bytes may conceivably block for a longer period of time is right after boot, when the whole system is still low on entropy.
+
+In general, anything async comes with some overhead on it's own.
+
+@returns A promise which resolves to a randomized string.
+
+@example
+```
+import {cryptoRandomStringAsync} from 'crypto-random-string';
+
+await cryptoRandomStringAsync({length: 10});
+//=> '2cf05d94db'
+```
+*/
+export function cryptoRandomStringAsync(options: Options): Promise<string>;

package/index.js

@@ -0,0 +1,13 @@
+// TODO: When targeting Node.js 16, remove `cryptoRandomStringAsync` and use `crypto.webcrypto.getRandomValues` to interop with the browser code.
+// TODO: Later, when targeting Node.js 18, only use the browser code
+import {promisify} from 'node:util';
+import {randomBytes} from 'node:crypto';
+import {createStringGenerator, createAsyncStringGenerator} from './core.js';
+
+const randomBytesAsync = promisify(randomBytes);
+
+export default createStringGenerator((byteLength, type, length) => randomBytes(byteLength).toString(type).slice(0, length), size => new Uint8Array(randomBytes(size)));
+export const cryptoRandomStringAsync = createAsyncStringGenerator(async (byteLength, type, length) => {
+	const buffer = await randomBytesAsync(byteLength);
+	return buffer.toString(type).slice(0, length);
+}, async size => new Uint8Array(await randomBytesAsync(size)));

package/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@depup/crypto-random-string",
+  "version": "5.0.0-depup.0",
+  "description": "[DepUp] Generate a cryptographically strong random string",
+  "license": "MIT",
+  "repository": "sindresorhus/crypto-random-string",
+  "funding": "https://github.com/sponsors/sindresorhus",
+  "author": {
+    "name": "Sindre Sorhus",
+    "email": "sindresorhus@gmail.com",
+    "url": "https://sindresorhus.com"
+  },
+  "type": "module",
+  "exports": {
+    "types": "./index.d.ts",
+    "node": "./index.js",
+    "browser": "./browser.js"
+  },
+  "engines": {
+    "node": ">=14.16"
+  },
+  "scripts": {
+    "test": "xo && ava && tsd"
+  },
+  "files": [
+    "index.js",
+    "browser.js",
+    "core.js",
+    "index.d.ts",
+    "changes.json",
+    "README.md"
+  ],
+  "keywords": [
+    "depup",
+    "dependency-bumped",
+    "updated-deps",
+    "crypto-random-string",
+    "random",
+    "string",
+    "text",
+    "id",
+    "identifier",
+    "slug",
+    "salt",
+    "pin",
+    "crypto",
+    "strong",
+    "secure",
+    "hex",
+    "secret",
+    "protect"
+  ],
+  "dependencies": {
+    "type-fest": "^5.4.4"
+  },
+  "devDependencies": {
+    "ava": "^4.2.0",
+    "dot-prop": "^7.2.0",
+    "tsd": "^0.20.0",
+    "xo": "^0.48.0"
+  },
+  "depup": {
+    "changes": {
+      "type-fest": {
+        "from": "^2.12.2",
+        "to": "^5.4.4"
+      }
+    },
+    "depsUpdated": 1,
+    "originalPackage": "crypto-random-string",
+    "originalVersion": "5.0.0",
+    "processedAt": "2026-03-17T16:35:11.633Z",
+    "smokeTest": "passed"
+  }
+}

package/readme.md

@@ -0,0 +1,125 @@
+# crypto-random-string
+
+> Generate a [cryptographically strong](https://en.wikipedia.org/wiki/Strong_cryptography) random string
+
+Can be useful for creating an identifier, slug, salt, PIN code, fixture, etc.
+
+Works in Node.js and browsers.
+
+## Install
+
+```sh
+npm install crypto-random-string
+```
+
+## Usage
+
+```js
+import cryptoRandomString from 'crypto-random-string';
+
+cryptoRandomString({length: 10});
+//=> '2cf05d94db'
+
+cryptoRandomString({length: 10, type: 'base64'});
+//=> 'YMiMbaQl6I'
+
+cryptoRandomString({length: 10, type: 'url-safe'});
+//=> 'YN-tqc8pOw'
+
+cryptoRandomString({length: 10, type: 'numeric'});
+//=> '8314659141'
+
+cryptoRandomString({length: 6, type: 'distinguishable'});
+//=> 'CDEHKM'
+
+cryptoRandomString({length: 10, type: 'ascii-printable'});
+//=> '`#Rt8$IK>B'
+
+cryptoRandomString({length: 10, type: 'alphanumeric'});
+//=> 'DMuKL8YtE7'
+
+cryptoRandomString({length: 10, characters: 'abc'});
+//=> 'abaaccabac'
+```
+
+## API
+
+### cryptoRandomString(options)
+
+Returns a randomized string. [Hex](https://en.wikipedia.org/wiki/Hexadecimal) by default.
+
+### cryptoRandomStringAsync(options)
+
+Returns a promise which resolves to a randomized string. [Hex](https://en.wikipedia.org/wiki/Hexadecimal) by default.
+
+For most use-cases, there's really no good reason to use this async version. From the Node.js docs:
+
+> The `crypto.randomBytes()` method will not complete until there is sufficient entropy available. This should normally never take longer than a few milliseconds. The only time when generating the random bytes may conceivably block for a longer period of time is right after boot, when the whole system is still low on entropy.
+
+In general, anything async comes with some overhead on it's own.
+
+```js
+import {cryptoRandomStringAsync} from 'crypto-random-string';
+
+await cryptoRandomStringAsync({length: 10});
+//=> '2cf05d94db'
+```
+
+#### options
+
+Type: `object`
+
+##### length
+
+*Required*\
+Type: `number`
+
+Length of the returned string.
+
+##### type
+
+Type: `string`\
+Default: `'hex'`\
+Values: `'hex' | 'base64' | 'url-safe' | 'numeric' | 'distinguishable' | 'ascii-printable' | 'alphanumeric'`
+
+Use only characters from a predefined set of allowed characters.
+
+Cannot be set at the same time as the `characters` option.
+
+The `distinguishable` set contains only uppercase characters that are not easily confused: `CDEHKMPRTUWXY012458`. It can be useful if you need to print out a short string that you'd like users to read and type back in with minimal errors. For example, reading a code off of a screen that needs to be typed into a phone to connect two devices.
+
+The `ascii-printable` set contains all [printable ASCII characters](https://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters): ``!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~`` Useful for generating passwords where all possible ASCII characters should be used.
+
+The `alphanumeric` set contains uppercase letters, lowercase letters, and digits: `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789`. Useful for generating [nonce](https://developer.mozilla.org/en-US/docs/Web/API/HTMLOrForeignElement/nonce) values.
+
+##### characters
+
+Type: `string`\
+Minimum length: `1`\
+Maximum length: `65536`
+
+Use only characters from a custom set of allowed characters.
+
+Cannot be set at the same time as the `type` option.
+
+## Related
+
+- [random-int](https://github.com/sindresorhus/random-int) - Generate a random integer
+- [random-float](https://github.com/sindresorhus/random-float) - Generate a random float
+- [random-item](https://github.com/sindresorhus/random-item) - Get a random item from an array
+- [random-boolean](https://github.com/arthurvr/random-boolean) - Get a random boolean
+- [random-obj-key](https://github.com/sindresorhus/random-obj-key) - Get a random key from an object
+- [random-obj-prop](https://github.com/sindresorhus/random-obj-prop) - Get a random property from an object
+- [unique-random](https://github.com/sindresorhus/unique-random) - Generate random numbers that are consecutively unique
+
+---
+
+<div align="center">
+	<b>
+		<a href="https://tidelift.com/subscription/pkg/npm-crypto-random-string?utm_source=npm-crypto-random-string&utm_medium=referral&utm_campaign=readme">Get professional support for this package with a Tidelift subscription</a>
+	</b>
+	<br>
+	<sub>
+		Tidelift helps make open source sustainable for maintainers while giving companies<br>assurances about security, maintenance, and licensing for their dependencies.
+	</sub>
+</div>