Dev.to Security πŸ” Cybersecurity πŸ‘ 0 πŸ“– 3 min read

The Password Generator's Batch Layer: Ten Results, One Strength Label, Ten Copy Controls

I work on OnePassApps, the team behind app.onepassapps.com. The Password Generator is one of the live apps on the site. Everything below was measured on the live panel today, 11 November 2026, signed out, in one browser,

I work on OnePassApps, the team behind app.onepassapps.com. The Password Generator is one of the live apps on the site. Everything below was measured on the live panel today, 11 November 2026, signed out, in one browser, and every number and every quoted sentence was read back off that panel.

You can try it at the Password Generator, and the rest of the apps are listed in the app guides.

The control the panel calls "How many"

The panel is three numbered steps: 01 Type, 02 Password settings, 03 How many.

Step 03 holds one range input, and the page itself says what it is: the labels around it read "How many" and "Results", and the input's own attributes are minimum 1, maximum 10, step 1, with a starting value of 1.

The step 02 length control has the same shape: minimum 8, maximum 128, step 1, starting at 20.

Ten results, and a copy control for each one

With the count at 10, the panel prints ten results, numbered 1 to 10, one per line. Every line has its own copy control, and the app names them: the buttons carry the labels "Copy result 1" through "Copy result 10". There is one more control under the list, and it says what it does: "Copy all, one per line".

The panel also names the whole batch in its own words, and the wording changes with the count. With a single result the button reads "Generate new"; with ten it reads "Generate new results".

One strength label for the whole batch, not one per row

This is the part worth knowing before you use it. The strength estimate is printed once, above the list, not once per result. At the default settings, with the length control still reading 20, the label above the ten results read "Very strong Β· about 129 bits".

The explanation under the label changes with the batch too. With one result it describes "this result"; with ten it reads "An estimate from how these results were generated (its settings), not from the text itself." and goes on: "It assumes an attacker knows the settings. Below 50 bits is weak, 50 to 79 fair, 80 to 99 strong, 100 or more very strong."

So the number is worked out from the settings you chose, and it is printed once for the whole batch. Ten rows of different text, one number.

Copying one result copies that result

I pressed the first copy control and watched what the page handed the clipboard. It passed exactly the twenty characters shown on row 1 and nothing else: the same twenty characters the panel displayed, with no trailing newline and no other result attached.

The panel confirmed it in one line: "Result 1 copied."

A new batch replaces all ten at once

Pressing "Generate new results" replaced every line at once. All ten rows changed, the numbering stayed 1 to 10, and the panel printed its own summary of what it had just done: "10 results generated, 129 bits (estimate)."

The bit count did not move, which is what you would expect from a number that comes from the settings rather than from the text.

What I did not measure

  • The "Hide all" control is there in the batch panel, but I did not press it, so I cannot say what it hides or whether it works per row.
  • I stayed on the Password tab. The passphrase side has its own word count and separator settings, and I did not measure its batch.
  • The site's own guide page describes a batch as running from one to ten results. That is the guide's wording, quoted as the guide's wording; the measurements above are from the Password tab only.
  • One build, one browser, one signed-out session, one day. The count slider was set to its maximum programmatically and read back off the input, and the clipboard was observed by recording what the page passed to the clipboard API rather than by reading the clipboard from another application. Nothing was submitted anywhere and no account was used. The panel's own line says it too: "Nothing leaves this tab."
πŸ“° Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β€” full credit and traffic to the original publisher.