# Secure password generation

`PasswordGenerator` owns `pass generate` semantics in `crates/storage`.
Production calls use `OsRng`; tests inject a deterministic cryptographic RNG.
Random bytes are converted to character indexes with fallible rejection
sampling, so arbitrary set sizes have no modulo bias and operating-system RNG
failure is reported before repository mutation.

The default is 25 characters from printable ASCII punctuation and
alphanumerics. `--no-symbols` selects ASCII letters and digits. A
`GeneratorConfig` may supply another Unicode character set and default length.
Lengths must be 1 through 4096. Sets must be nonempty and contain no duplicate
or control characters; rejecting duplicates prevents accidental weighting.

Normal generation uses the same overwrite decision and `--force` rules as
insert. `--in-place` requires an existing entry, decrypts it, replaces only the
bytes before its first newline, and preserves that newline and every following
byte exactly. The generated password is returned separately as redacted,
zeroizing data for typed terminal, clipboard, or QR presentation.

The completed entry is encrypted for the nearest recipient policy and written
atomically. Embedded Git receives `Add generated password for ...` only after a
successful write. Decline, missing in-place targets, validation, randomness,
encryption, and commit failures leave the previous repository state intact;
commit failure uses the write-domain rollback path.