mint_

Randomness you can ship.

Cryptographically secure secrets, passwords and IDs in one zero-dependency command. Protect what you ship with mint guard.

npm install -g @xnah/mint
Read the docsGitHub (opens in a new tab)npm (opens in a new tab)

Terminal demo

mintsession
v1.1.0

Example terminal output. mint uuid: 33c6e3de-6cb2-4075-b21c-1547149ccbde. mint password --length 24: +@<,+YXIt-;u,hL,8{%]pQ3#. mint jwt-secret --algo hs512 --env JWT_SECRET: JWT_SECRET=<redacted> entropy: 512 bits. mint guard scan: mint guard · worktree scan ! 2 findings in 3 scanned files CRITICAL src/lib/stripe.ts:21 sk_l...Xq HIGH .env.local:4 ghp_...9f next: mint guard rotate-help stripe-secret-key. This demo is decorative and runs only in your browser.

generators
0one flag surface
guard rules
0plus entropy detection
runtime deps
0Node 18 and nothing else
report formats
0text, JSON, SARIF, Markdown

Secure by construction.

The only entropy source is node:crypto. The rest is careful sampling, honest entropy math and a CLI that gets out of your way.

CSPRNG only

Every byte comes from node:crypto. No Math.random, no clock fallback, no seeded state to leak.

src/random.tscrypto
const bytes = randomBytes(32);
// 256 bits, straight from the CSPRNG

Zero dependencies

Nothing added to your node_modules tree.

0

runtime packages

39 generators

From raw bytes to TypeIDs, all with the same flags.

0

mint <n>

Bias-free sampling

Rejection sampling for characters, integers and shuffles. No modulo shortcuts.

Offline, always

No network calls, telemetry or update checks. It works on a plane.

network: disabled

Pipe-friendly

One value on stdout. JSON when you need structure. Color only on a TTY.

mint token --bytes 32 | pbcopy

MIT, open source

Read the sampling code, audit the scanner rules, or add a generator. The source is the documentation.

h4nxxlmao/mint

mint generate

One command. Dozens of shapes.

Pick a generator, pass a flag, get a value on stdout. The same flag surface works across raw bytes, identifiers, passwords and dev keys.

Bearer tokens, signing keys and API keys with an optional checksum.

mint jwt-secret --algo hs512
dW3t...ExQ

512-bit HS512 signing secret, 64 bytes (sample redacted)

mint apikey --prefix sk_live_ --length 24 --checksum
sk_live_BAkCh...ACTE

API key with a typo-catching checksum (sample redacted)

mint token --bytes 16
kZGXmckPRMI68kk82oTP0A

Generic URL-safe bearer token

Sample output. Every value is generated locally with your CSPRNG.

Browse every generator

mint guard

Protect what you ship.

Find leaked secrets before they leave your machine. Offline, redacted by default, and ready for a pre-commit hook or CI.

mint guard scans a working tree, the git index or an entire history for credentials. It never sends data anywhere, never edits a file and never prints the full value.

32

built-in rules

4

report formats

Detects

Cloud keysSource-host tokensAI provider keysPrivate key blocksDatabase URLsJWTsHard-coded credentials.env hygiene
How mint guard worksView the rules on GitHub (opens in a new tab)
$ mint guard scanexample report

! 3 findings in 48 files

0.34s

  • criticalsrc/lib/stripe.ts:21sk_l...Xq

    Stripe secret key

    fix: mint apikey --prefix sk_live_ --length 32 --checksum

  • high.env.local:4ghp_...9f

    GitHub token

    fix: mint token --bytes 32

  • mediumscripts/publish.ts:8n4...Qz

    Hard-coded credential

    fix: mint password --length 32 --no-ambiguous

Preview only. Values are never printed in full, stored in reports or written to the baseline.

Pre-commit hook

# .git/hooks/pre-commit
mint guard scan --staged --fail-on medium

install-hook never clobbers an existing hook unless you pass --force.

GitHub Actions

- run: npx @xnah/mint guard scan --fail-on high --format sarif > mintguard.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: mintguard.sarif

SARIF findings upload to code scanning with redacted previews.

Playground

Try it without installing anything.

Generate values and scan pasted code in the browser. Web Crypto does the work, and nothing leaves the tab.

39 generatorsclient-side guard scanentropy readoutno uploads
Open the playground
mint nanoid --size 12

gkP2vci-kG7f

72 bits · URL-safe · 64-symbol alphabet

generated locally with crypto.getRandomValues

Install once. Use everywhere.

Install it globally, run it with npx, or add it to a project. The binary is called mint; the package is @xnah/mint.

npm install -g @xnah/mint

Node.js 18 or newer. The package installs a mint binary. No postinstall script, no telemetry.

Package on npmSource on GitHub

Questions, answered.

A few things people ask before they pipe it into a production secret manager.

Read the full FAQOpen an issue
Does mint use Math.random anywhere?

No. The only entropy source is node:crypto. Every character, integer and shuffle is drawn through rejection sampling, so mapping randomness onto a shorter alphabet never introduces modulo bias.

Do I need to be online to use it?

No. The package has zero runtime dependencies and never makes a network request. mint guard is offline too, including its rule set and rotation guidance.

Can I use the output in scripts and pipelines?

Yes. Values go to stdout, one per line, and colors only appear on a TTY. Use --json for structured output, --env for environment assignments, and --no-newline when a tool needs an exact value.

Does mint guard ever print the full secret?

No. Text, JSON, SARIF, Markdown and baseline output only contain a redacted preview (first four and last two characters) or a salted hash. Values shorter than 12 characters are fully masked.

Does mint guard rewrite my files or git history?

No. It reads your project and reports findings. --fix only prints the rotation plan. History cleanup is shown as a command in the guidance, never executed.

Is the playground connected to the CLI or to a server?

No. Every generator and every guard check on this site runs in your browser with Web Crypto. Nothing you type or generate is sent anywhere.