Password Generator & Secrets Manager: One Audited Toolchain
A free password and passphrase generator that never stores what it creates, backed by a self-hosted, AWS Secrets Manager-compatible service with AES-256-GCM encryption at rest.
Most password generators ask for trust without showing anything. The page produces a string, the string disappears, and the visitor cannot tell whether the randomness is real, whether the value was logged, or whether the same code runs anywhere else.
This toolchain answers those questions with one audited implementation. The browser UI and the Python CLI share the same generator, built on secrets.SystemRandom. Nothing generated is stored, logged, or sent to a third party. Behind the generator sits a self-hosted secrets service that speaks the AWS Secrets Manager protocol, so applications can keep runtime secrets in the same stack.
The Problem
Free password tools usually fail in one of two directions. Either the generation happens in an opaque script with no explanation, or the tool is a thin wrapper over a service that sees the password. Teams then need a second product for application secrets, and the two systems drift.
The requirement was a public utility that is honest about how it works, plus a secrets store the apps can reach with standard AWS tooling, without adopting a cloud account for a small deployment.
The Approach
One Python generator is the source of truth. It produces character passwords and EFF Diceware passphrases with secrets.SystemRandom, applies per-class counts and ambiguity filters, and is invoked by both the CLI and the Next.js API. The browser never generates with Math.random, and the API never writes the result.
The secrets service is a dependency-free Node.js implementation of the AWS Secrets Manager wire protocol: AWS JSON 1.1, SigV4 request verification, AWS-style errors, versions and staging labels, idempotent client request tokens, soft delete with a recovery window, tags, and prefix-scoped client credentials. Values are encrypted with AES-256-GCM using a random 96-bit IV and AAD bound to the secret ARN and version id.
Both services run in Docker. The app and the secrets service bind to loopback, and host nginx terminates TLS and proxies to them. Development and production use separate Compose projects, line-aligned env files, full-volume backups with manifests and checksums, and one control script for start, health, smoke, backup, restore, and secret operations.
The Outcome
Live at password.agiolab.com and secrets.agiolab.com. The generator is free, public, and account-free. The secrets service answers health checks and the AWS protocol, and the repo ships an OpenAPI spec, a client integration guide, and AWS CLI, SDK v3, and boto3 verification.
The code is MIT licensed and public. Verification is done by smoke tests, protocol checks, and restore drills rather than a large unit suite, and the service was exercised against the real AWS clients.
Open the free generator
Free and public, no account. The Secrets Manager is an authenticated API at secrets.agiolab.com, compatible with the AWS CLI, SDK v3, and boto3.
Key Takeaway
A password generator is easy to write and hard to trust. The useful part is one audited engine, a public UI, and a secrets service that proves the value was never stored.
Ready to Build Your Platform?
One 30-minute call to see if I'm the right fit. No pitch. No pressure. In English or Spanish, just a conversation about what you need to build.
Every engagement is scoped and quoted individually. There is no rate card, and no price before I understand the system. The first step is a 30-minute call, in English or Spanish; you leave it with a clear read on scope, sequence, and what the work would take.