Add Password generator to the roadmap

docs/README.md

@@ -10,19 +10,20 @@ this table is the release or the proposed place in line, not a promise that a La
 may not appear on the public index. **Next** is the next proposed new app, not work already
 under way; **Planned** is a later proposal. Future rows are ordered by build priority.
 
-| App                        | Status  | Purpose                                                                                                                                                   |
-| -------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [SVG](apps/svg.md)         | Stable  | Trace images with a Bézier pen and shapes; combine, align, group and fill with gradients. A searchable library of drawings, exported as clean SVG or PNG. |
-| [JSON](apps/json.md)       | Stable  | Format, minify, fold and validate JSON, and fix almost-JSON. Convert it to YAML, CSV, TypeScript types or a JSON Schema.                                  |
-| [JWT](apps/jwt.md)         | Stable  | Decode, encode and verify JSON Web Tokens with HMAC, RSA, ECDSA and Ed25519.                                                                              |
-| [Codes](apps/codes.md)     | Stable  | QR codes for links, Wi-Fi, contacts, events and more, with your colours, shapes, logo and frame; plus Code 128, EAN-13 and UPC-A barcodes.                |
-| [Codec](apps/codec.md)     | Stable  | Convert UTF-8 text, Base64, Base64url, URL components and hex, with every byte visible.                                                                   |
-| [Digests](apps/digests.md) | Stable  | Hash text and files with every SHA at once, check an expected digest, and compute HMAC.                                                                   |
-| [Time](apps/time.md)       | Stable  | Convert Unix timestamps and ISO dates across time zones, find a call time for people in several zones, and measure durations and ages.                    |
-| [Diff](apps/diff.md)       | Next    | Compare two texts or JSON documents, with clear changes and navigation.                                                                                   |
-| [Certs](apps/certs.md)     | Planned | Inspect X.509 certificates, chains and related data.                                                                                                      |
-| [Notes](apps/notes.md)     | Planned | Write Markdown and organise a small local collection of notes.                                                                                            |
-| [Magnet](apps/magnet.md)   | Planned | Inspect torrent metadata and convert infohashes and magnet links.                                                                                         |
+| App                          | Status  | Purpose                                                                                                                                                   |
+| ---------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [SVG](apps/svg.md)           | Stable  | Trace images with a Bézier pen and shapes; combine, align, group and fill with gradients. A searchable library of drawings, exported as clean SVG or PNG. |
+| [JSON](apps/json.md)         | Stable  | Format, minify, fold and validate JSON, and fix almost-JSON. Convert it to YAML, CSV, TypeScript types or a JSON Schema.                                  |
+| [JWT](apps/jwt.md)           | Stable  | Decode, encode and verify JSON Web Tokens with HMAC, RSA, ECDSA and Ed25519.                                                                              |
+| [Codes](apps/codes.md)       | Stable  | QR codes for links, Wi-Fi, contacts, events and more, with your colours, shapes, logo and frame; plus Code 128, EAN-13 and UPC-A barcodes.                |
+| [Codec](apps/codec.md)       | Stable  | Convert UTF-8 text, Base64, Base64url, URL components and hex, with every byte visible.                                                                   |
+| [Digests](apps/digests.md)   | Stable  | Hash text and files with every SHA at once, check an expected digest, and compute HMAC.                                                                   |
+| [Time](apps/time.md)         | Stable  | Convert Unix timestamps and ISO dates across time zones, find a call time for people in several zones, and measure durations and ages.                    |
+| [Diff](apps/diff.md)         | Next    | Compare two texts or JSON documents, with clear changes and navigation.                                                                                   |
+| [Certs](apps/certs.md)       | Planned | Inspect X.509 certificates, chains and related data.                                                                                                      |
+| [Notes](apps/notes.md)       | Planned | Write Markdown and organise a small local collection of notes.                                                                                            |
+| [Magnet](apps/magnet.md)     | Planned | Inspect torrent metadata and convert infohashes and magnet links.                                                                                         |
+| [Password](apps/password.md) | Planned | Generate strong passwords and passphrases with your choice of length, characters and words.                                                               |
 
 ## Shared groundwork and boundaries
 

docs/apps/password.md

@@ -0,0 +1,27 @@
+# Password
+
+Not built yet. Status and build order are on the [roadmap](../README.md).
+
+Purpose: generate strong passwords and passphrases locally, with their strength shown plainly.
+
+Initial scope:
+
+- Random passwords with a chosen length and character sets (lower, upper, digits, symbols),
+  an option to leave out look-alike characters, and at least one character from each chosen set.
+- Passphrases from a built-in word list, with a chosen word count, separator and optional
+  capitals or digit.
+- Entropy in bits for every result, worked out from the settings rather than guessed from the
+  text.
+- Several results at once to pick from, each copyable, and a regenerate button.
+
+All randomness comes from `crypto.getRandomValues`, with rejection sampling so every character
+and word is equally likely. Nothing generated is stored: settings are kept, results are not.
+
+Out of scope: a password manager, saving or syncing passwords, and checking passwords against
+breach lists.
+
+## Decisions before implementation
+
+- Which word list ships for passphrases (EFF large list or similar) and its effect on the
+  bundle budget.
+- Whether a strength check for a typed password belongs in the first release.

package.json

@@ -47,7 +47,7 @@
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
     "@eslint/js": "^10.0.1",
-    "@happy-dom/global-registrator": "^21.0.1",
+    "@happy-dom/global-registrator": "^21.0.4",
     "@playwright/test": "1.64.0",
     "@tools/ui": "workspace:*",
     "@types/bun": "^1.4.3",