System Requirements Document for just-password

1. Introduction

just-password is a simple, fast, mobile-first Secure Password Generator for people who need a strong password immediately.

The product prioritizes the direct workflow:

Open → Generate → Copy → Done

Users can optionally customize password composition and save generated passwords locally on their device. The product must remain anonymous, privacy-focused, lightweight, and easy to leave after use. It must not require an account, signup, login, email address, cloud storage, or server-side password handling.

2. System Overview

just-password is an anonymous browser-based utility with a custom responsive interface. It generates passwords locally using secure cryptographic randomness and supports optional device-only saved passwords.

Current accepted product behavior includes:

• A public Landing page that introduces the utility and its immediate password-generation purpose.
• A Generator page containing the primary password-generation workflow.
• A Saved Passwords page for locally stored generated passwords.
• Password length and character-set customization.
• A password strength indicator with the levels Weak, Fair, Strong, and Very Strong.
• Copy actions for generated and saved passwords.
• Optional local saving with a user-provided label.
• Display advertising that does not disrupt password generation, copying, or saving.

The active human audience is limited to:

• Password Generator User
• Saved Password Keeper

No accounts, role-based access, profiles, cloud synchronization, password sharing, payments, subscriptions, social features, AI chat, notifications, or dashboards are included.

2a. Product Interpretation and Delivery Boundary

just-password is delivered as an anonymous, first-party browser utility. All password generation occurs on the user’s device through secure browser cryptographic randomness such as crypto.getRandomValues().

The application does not create user accounts or maintain server-side password records. Saved passwords remain only in local device storage and may be lost if browser or app data is cleared, the app is uninstalled, or the device is lost.

The primary application pages are publicly accessible without identity establishment:

1. Landing
2. Generator
3. Saved Passwords

Display advertising is permitted as the only monetization model. Advertisements must remain visually and functionally secondary to the password workflow and must not receive, contain, log, or expose password values.

2c. Page Content and Component Coverage

Landing

• Purpose and information

  • Introduces just-password as a fast, anonymous Secure Password Generator.
  • Shows the prompt: “Need a strong password? Generate one.”
  • Communicates the local-only product promise without claiming passwords are unhackable.
  • Presents the application as a lightweight utility for immediate use.

• Primary actions

  • Provides a direct entry to the Generator page.
  • Provides access to the Saved Passwords page as an optional secondary destination.

• Supporting information

  • Displays the persistent local-only message: ON THIS DEVICE · NO ACCOUNT · NO SYNC.
  • Indicates that no signup, email address, login, or cloud account is required.

• Interface responsibilities

  • Uses a thin top rail with the just-password wordmark, local-only status marker, and Saved Passwords count link.
  • Keeps the Generator workflow visually dominant over saved-password management.
  • May contain a tasteful display advertisement only outside the primary generator action path.

• States

  • Default state presents the prompt and Generator entry action.
  • If saved passwords exist locally, the Saved count reflects the current local entry count.
  • If local storage cannot be read, the page continues to provide Generator access and does not expose unavailable saved-password data.

Generator

• Purpose and information

  • Owns the core password workflow: Open → Generate → Copy → Done.
  • Shows the prompt: “Need a strong password? Generate one.”
  • Displays a generated password, such as v8#Qm2!Lz9@T4.
  • Uses a generated-password display that supports controlled wrapping or character grouping so horizontal overflow is avoided.

• Primary actions

  • GENERATE creates a password locally using secure cryptographic randomness.
  • COPY copies the currently displayed password to the clipboard.
  • SAVE is optional and stores the currently displayed password locally after the user supplies a label.

• Password controls

  • Length control constrained to 8–64 characters.
  • Uppercase letters toggle.
  • Lowercase letters toggle.
  • Numbers toggle.
  • Symbols toggle.
  • Optional Avoid confusing characters toggle excluding 0/O, 1/l/I.
  • Controls are presented as numbered ruled rows:
    • 01 LENGTH
    • 02 CHARACTER SET
    • 03 CLARITY

• Strength indicator

  • Shows a textual strength result: Weak, Fair, Strong, or Very Strong.
  • Shows a four-cell strength rail with printed level names.
  • Uses text in addition to color so strength is not conveyed through color alone.
  • Uses orange for active non-green indicator states and green for Strong and Very Strong only.

• Save interaction

  • When SAVE is selected, prompts for a simple local label such as Instagram, Wi-Fi, or Netflix.
  • Saves the label and password only to local device storage.
  • Provides a visible success result when the password is saved.
  • Provides recovery messaging if local storage is unavailable or saving fails.

• Advertising

  • May contain a tasteful display advertisement outside the generator module and outside the Generate, Copy, and Save action sequence.
  • Must not place advertisements inside the generator module or between GENERATE, COPY, and SAVE.
  • Must not use forced video advertisements, pop-ups, or other interruptive ad experiences.

• States

  • Initial state displays a generated password and its strength result.
  • Generating state briefly cycles masked character slots before presenting the newly generated value.
  • Copy success state changes COPY to COPIED.
  • Invalid composition state prevents generation when no character set is selected and explains that at least one character set must be enabled.
  • Clipboard failure state keeps the password visible and informs the user that copying did not complete so they can retry.
  • Save failure state keeps the generated password visible and allows the user to retry saving or continue without saving.

Saved Passwords

• Purpose and information

  • Provides the source-named Saved Passwords section for locally stored generated passwords.
  • Shows saved entries with their user-provided labels and stored password values.
  • Displays the persistent local-storage warning:
    • Saved passwords may be lost if browser or app data is cleared.
    • Saved passwords may be lost if the app is uninstalled.
    • Saved passwords may be lost if the device is lost.
  • States that saved passwords remain on the device only and are not synchronized to the cloud.

• Primary actions

  • COPY copies an individual saved password.
  • DELETE removes an individual saved password from local device storage.
  • DELETE ALL removes all locally saved password entries.

• Supporting actions

  • Returns the user to the Generator page to create another password.
  • Shows the local saved-password count through the shared top rail.

• Domain entities

  • Saved Password entry:
    • Label
    • Password value
    • Local-device-only storage state

• Interface responsibilities

  • Clearly separates each saved entry from neighboring entries.
  • Keeps copy and deletion controls associated with the relevant local entry.
  • Keeps DELETE ALL visually distinct as a destructive action without adding unrelated account or archive behavior.
  • Does not present sharing, exporting, cloud backup, synchronization, account recovery, or remote password access controls.

• States

  • Empty state explains that no passwords are currently saved locally and provides a path to Generator.
  • Populated state lists all locally stored entries.
  • Copy success state confirms the copied saved password.
  • Copy failure state retains the entry and allows retry.
  • Individual deletion success removes the selected entry from the visible list.
  • Delete All success shows an empty list state.
  • Local storage failure state explains that saved entries cannot be loaded or changed while preserving access to Generator.

3. Functional Requirements

FR-01 — Access the anonymous password generator

As a Password Generator User, I should be able to open just-password without an account, email address, signup, or login so that I can start generating a strong password immediately.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: The user opens the application.
• Required behavior:
  • The application shall present the prompt: “Need a strong password? Generate one.”
  • The application shall provide access to the Generator page.
  • The application shall not request identity, authentication, email, account creation, or profile setup.
• Observable result: The user can reach the password-generation workflow immediately.
• Failure/recovery: If local saved-password storage is unavailable, the application shall still allow anonymous password generation.
• Continuation: The user proceeds to generate a password or optionally visits Saved Passwords.

FR-02 — Generate a secure local password

As a Password Generator User, I should be able to generate a password locally so that I can obtain a strong password in seconds.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: The user opens Generator or selects GENERATE.
• Required behavior:
  • The application shall display a generated password, such as v8#Qm2!Lz9@T4.
  • The application shall generate passwords locally on the device.
  • The application shall use secure cryptographic randomness such as crypto.getRandomValues().
  • The application shall never use Math.random() for password generation.
  • The application shall not transmit, log, sell, or store generated password values in a server-side database.
• Observable result: A newly generated password is visible with an associated strength result.
• Failure/recovery: If secure browser cryptographic randomness is unavailable, the application shall not substitute insecure randomness and shall explain that secure password generation cannot proceed in the current environment.
• Continuation: The user can copy, save, customize, or regenerate the password.

FR-03 — Customize password composition

As a Password Generator User, I should be able to customize password length and included character types so that the generated password fits the destination’s requirements.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: The user changes Generator controls before generating another password.
• Required behavior:
  • The application shall allow a password length from 8 to 64 characters.
  • The application shall allow the user to include or exclude uppercase letters.
  • The application shall allow the user to include or exclude lowercase letters.
  • The application shall allow the user to include or exclude numbers.
  • The application shall allow the user to include or exclude symbols.
  • The application shall provide an optional Avoid confusing characters setting for 0/O, 1/l/I.
  • The next generated password shall reflect the selected settings.
• Observable result: The selected configuration is visibly represented in the Generator controls and affects subsequent password generation.
• Failure/recovery: If the user disables all character sets, the application shall prevent generation and instruct the user to enable at least one character set.
• Continuation: The user selects GENERATE to receive a password based on the current settings.
• Required inference: Preventing generation with no available characters is necessary to produce a valid password without adding a separate capability.

FR-04 — View password strength

As a Password Generator User, I should be able to see a simple strength indicator so that I can understand the generated password’s strength level.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: A password is displayed or regenerated.
• Required behavior:
  • The application shall show one of these strength levels: Weak, Fair, Strong, or Very Strong.
  • The application shall show the active level through a four-cell strength rail and adjacent textual status.
  • The application shall not rely on color alone to communicate strength.
• Observable result: The password’s current strength level is visible beside or beneath the generated password.
• Failure/recovery: If a password cannot be generated because no character set is selected, the application shall not present a misleading strength result.
• Continuation: The user can adjust controls and regenerate or copy the displayed password.

FR-05 — Copy a generated password

As a Password Generator User, I should be able to copy the generated password so that I can use it outside the application.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: The user selects COPY for the currently displayed generated password.
• Required behavior:
  • The application shall use available clipboard access to copy the currently displayed password.
  • The application shall change the action label from COPY to COPIED after successful copying.
  • The generated password shall remain visible after the copy action.
• Observable result: The password is available in the device clipboard and the user receives visible copy confirmation.
• Failure/recovery: If clipboard access is denied or copying fails, the application shall indicate that copying did not complete and allow the user to retry while keeping the password visible.
• Continuation: The user can leave after copying, generate another password, or optionally save the password.
• Required inference: Clipboard access and failure feedback are required to make the accepted COPY action usable.

FR-06 — Save a generated password locally with a label

As a Saved Password Keeper, I should be able to save a generated password with a simple label so that I can retrieve it later on the same device.

• Provenance: explicit
• Access state: Public and anonymous; no account continuity is required.
• Trigger/input: The user selects optional SAVE for a generated password and provides a label such as Instagram, Wi-Fi, or Netflix.
• Required behavior:
  • The application shall allow saving only after a password has been generated.
  • The application shall collect a simple user-provided label.
  • The application shall store the label and password locally on the device only.
  • The application shall never send saved passwords to a server.
  • The application shall not synchronize saved passwords to the cloud.
  • The application shall not store passwords in a server-side database.
• Observable result: The saved password becomes available in Saved Passwords with its label.
• Failure/recovery: If local storage is unavailable or saving fails, the application shall keep the generated password visible, explain that it was not saved, and allow retry or continuation without saving.
• Continuation: The user can return to Generator, copy the current password, or visit Saved Passwords.

FR-07 — Review and copy saved passwords

As a Saved Password Keeper, I should be able to view and copy locally saved passwords so that I can retrieve a password I previously chose to retain.

• Provenance: explicit
• Access state: Public and anonymous; entries are available only through the current device’s local storage.
• Trigger/input: The user opens Saved Passwords or selects COPY for a saved entry.
• Required behavior:
  • The application shall provide a Saved Passwords section.
  • The application shall list locally stored password entries with their labels.
  • The application shall allow the user to copy an individual saved password.
  • The application shall clearly explain that saved passwords may be lost if browser or app data is cleared, the app is uninstalled, or the device is lost.
• Observable result: The selected saved password is copied and the user receives visible confirmation.
• Failure/recovery: If copy fails, the entry shall remain visible and the user shall be able to retry. If there are no saved entries, the application shall present an empty state and a path to Generator.
• Continuation: The user can copy another entry, delete entries, delete all entries, or generate a new password.

FR-08 — Delete saved passwords

As a Saved Password Keeper, I should be able to delete individual saved passwords or delete all saved passwords so that I can remove local entries I no longer want to retain.

• Provenance: explicit
• Access state: Public and anonymous; deletion affects only current-device local storage.
• Trigger/input: The user selects DELETE for an entry or DELETE ALL in Saved Passwords.
• Required behavior:
  • The application shall allow deletion of an individual locally saved password.
  • The application shall provide DELETE ALL.
  • The application shall remove deleted entries from local device storage.
  • The application shall not transmit deleted password values to a server.
• Observable result: The deleted entry disappears from the list, or the list becomes empty after Delete All.
• Failure/recovery: If local storage cannot be updated, the application shall explain that deletion did not complete and retain the visible entry state until a successful retry.
• Continuation: The user can continue managing remaining entries, return to Generator, or leave the application.

FR-09 — Display advertising without disrupting the utility

As a Password Generator User, I should be able to generate, copy, and optionally save passwords without advertising interrupting those actions so that the utility remains fast and uncluttered.

• Provenance: explicit
• Access state: Public and anonymous.
• Trigger/input: The user views Landing, Generator, or Saved Passwords.
• Required behavior:
  • The application shall use display advertising only.
  • Advertisement placement shall be tasteful and secondary to password tasks.
  • Advertisements shall not interfere with generating, copying, or saving passwords.
  • The application shall not use forced video advertisements.
  • The application shall not use annoying pop-ups.
  • Advertisements shall not be placed inside the Generator module or between GENERATE, COPY, and SAVE.
• Observable result: Any advertisement is visually separate from the main utility controls.
• Failure/recovery: If an advertisement fails to load, the password-generation and saved-password workflows shall remain usable.
• Continuation: The user continues their selected password task without advertisement-driven interruption.

4. User Personas

Password Generator User

Product context: A person who needs a strong password immediately and wants to complete the task in seconds without becoming a member of a service.

Primary goal: Generate a strong password, assess its visible strength, copy it, and leave.

Distinct responsibilities:

• Opens the public anonymous utility.
• Reviews the prompt: “Need a strong password? Generate one.”
• Generates a password using the default or customized composition.
• Adjusts length between 8 and 64 characters when required.
• Selects or deselects uppercase letters, lowercase letters, numbers, symbols, and optional avoidance of confusing characters.
• Reads the Weak, Fair, Strong, or Very Strong indicator.
• Copies the password through the COPY action.

Relevant inputs and decisions:

• Whether to use the displayed password or generate another.
• Desired length and character composition.
• Whether confusing characters should be excluded.
• Whether to copy the generated password.
• Whether to optionally save the password locally.

Interaction with other accepted participants: None. Password generation, strength display, copying, and optional saving are performed directly by the user without account holders, administrators, sharing recipients, or external approvers.

Observable success: The user obtains a locally generated password and sees COPIED after successfully placing it on the clipboard.

Persona provenance: required_inference from the accepted immediate-use password-generation journey.

Saved Password Keeper

Product context: A returning user who chooses to retain selected generated passwords locally on the same device without cloud synchronization or an account.

Primary goal: Save a generated password with a recognizable label and later retrieve, copy, or remove it from device-only local storage.

Distinct responsibilities:

• Selects SAVE after generating a password.
• Provides a simple label such as Instagram, Wi-Fi, or Netflix.
• Reviews locally stored entries in Saved Passwords.
• Copies a saved password when it is needed again.
• Deletes an individual saved password or uses DELETE ALL.
• Understands and accepts that saved passwords may be lost when browser or app data is cleared, the app is uninstalled, or the device is lost.

Relevant inputs and decisions:

• Whether a generated password should be saved.
• What simple label identifies the saved password.
• Which saved entry to copy or delete.
• Whether all local saved passwords should be deleted.

Interaction with other accepted participants: None. Saved passwords are retained only on the user’s current device and are not shared with cloud services, account owners, administrators, or recipients.

Observable success: The user sees the labeled password entry in Saved Passwords, can copy it when needed, and can remove it from local storage when no longer wanted.

Persona provenance: required_inference from the accepted optional local saved-password lifecycle.

5. Core User Flows

Flow 1 — Generate and copy a password

1. The Password Generator User opens Landing anonymously.
2. Landing displays: “Need a strong password? Generate one.”
3. The user proceeds to Generator without entering an email address, creating an account, signing up, or logging in.
4. Generator displays a locally generated password and its current strength indicator.
5. The user optionally adjusts length, uppercase letters, lowercase letters, numbers, symbols, or Avoid confusing characters.
6. The user selects GENERATE.
7. Generator uses secure cryptographic randomness such as crypto.getRandomValues() to generate a new password locally.
8. Generator displays the newly generated password and the applicable Weak, Fair, Strong, or Very Strong strength result.
9. The user selects COPY.
10. Generator writes the displayed password to the clipboard and changes the control state to COPIED.
11. The user leaves the application or continues with another optional action.

Failure and recovery:

• If no character type is selected, Generator prevents generation and directs the user to enable at least one character set.
• If secure cryptographic randomness is unavailable, Generator does not use Math.random() or another insecure substitute.
• If clipboard access fails, the generated password remains visible and the user can retry copying.

Flow 2 — Generate and save a labeled password locally

1. The Saved Password Keeper opens Generator anonymously.
2. Generator displays a current locally generated password.
3. The user optionally customizes password settings and selects GENERATE.
4. Generator generates a password locally through secure cryptographic randomness and displays its strength.
5. The user selects optional SAVE.
6. Generator asks the user for a simple label, such as Instagram, Wi‑Fi, or Netflix.
7. The user enters the label and completes the save action.
8. Generator stores the password and label only in local device storage.
9. Generator confirms that the password was saved.
10. The user can continue to Saved Passwords, copy the current password, generate another password, or leave.

Failure and recovery:

• If local storage is unavailable, Generator explains that the password was not saved.
• The generated password remains visible so the user can copy it, retry saving, or leave without saving.
• No cloud backup, server transmission, account creation, or synchronization alternative is offered.

Flow 3 — Retrieve and copy a locally saved password

1. The Saved Password Keeper opens Saved Passwords anonymously.
2. Saved Passwords loads the current device’s locally stored password entries.
3. The page displays the local-storage warning explaining that entries may be lost if browser or app data is cleared, the app is uninstalled, or the device is lost.
4. The user identifies an entry by its simple label.
5. The user selects COPY for the chosen saved password.
6. Saved Passwords copies the selected password to the clipboard.
7. Saved Passwords provides visible copy confirmation.
8. The user can copy another entry, delete entries, return to Generator, or leave.

Failure and recovery:

• If there are no saved passwords, Saved Passwords shows an empty state and directs the user to Generator.
• If copying fails, the saved entry remains available and the user can retry.
• If local storage cannot be read, Saved Passwords explains that entries cannot be loaded while preserving a path to Generator.

Flow 4 — Delete one saved password

1. The Saved Password Keeper opens Saved Passwords.
2. The user locates the labeled local password entry that should be removed.
3. The user selects DELETE for that entry.
4. Saved Passwords removes the selected entry from local device storage.
5. The page removes the entry from the visible list.
6. The user continues managing remaining entries, returns to Generator, or leaves.

Failure and recovery:

• If deletion cannot be written to local storage, the page explains that deletion did not complete.
• The entry remains visible until deletion succeeds, allowing the user to retry.

Flow 5 — Delete all saved passwords

1. The Saved Password Keeper opens Saved Passwords.
2. The user selects DELETE ALL.
3. Saved Passwords removes all saved password entries from local device storage.
4. Saved Passwords displays the empty saved-password state.
5. The user can return to Generator to create another password or leave the application.

Failure and recovery:

• If local storage cannot be updated, Saved Passwords explains that Delete All did not complete and retains the current visible entries until a successful retry.

6. Visuals Colors and Theme

Muse: Dieter Rams
Headline: Less, but safer — functional clarity after Dieter Rams

The visual system shall communicate calm, direct, mechanically dependable privacy. It must present just-password as a focused security utility rather than a marketing dashboard, consumer social application, or conventional blue-on-white SaaS product.

Color Tokens