Every new client onboarding, every rotated firewall admin password, every fresh service account — at some point a technician has to actually generate the credential. Where that generation happens matters more than most MSPs think about.
Browser-native generators are fine until you need a passphrase instead of a random string. Third-party generator websites are a worse idea than they look — you’re typing (or trusting a “random” output) from a page you don’t control, over a connection you can’t audit, for a credential that’s about to protect a client’s infrastructure. And “just make something up” is how you end up with Summer2026! on a domain admin account.
Weavestream builds a password generator directly into the credential creation flow — and it’s designed around a specific constraint: nothing it generates ever touches the network.
Local Generation, No Exceptions
The generator runs entirely client-side. No API call, no request to a remote service, no telemetry ping — the randomness is produced and assembled in the browser session where you’re creating the credential. For a platform whose whole pitch is “your client credentials never leave your infrastructure,” a generator that phones out to some third party for the raw material would undercut the point. Weavestream doesn’t do that.
This matters for the same reason self-hosting the rest of your documentation stack matters: every external dependency is a place credential material could theoretically be observed, logged, or intercepted, even briefly. An offline generator removes that path entirely, by construction, not by policy.
Three Modes, Because One Password Format Doesn’t Fit Every System
Open the generator from the password create/edit dialog and you get three approaches:
Words + symbols uses an EFF-style wordlist of 200 words, optionally combined with symbols. This is the format worth defaulting to for anything a human might need to type manually — a router console, a KVM session, a piece of legacy hardware without a paste buffer. Word-based passwords are dramatically easier to type correctly under pressure than a random string of mixed-case characters and punctuation, without giving up entropy.
Passphrase strings together multiple random words with a separator character. It’s the classic Diceware-adjacent approach — long, memorable in a pinch, and resistant to the kind of dictionary attacks that plague short passwords, precisely because length matters more than complexity once you’re past a reasonable character-class minimum.
Custom length is the traditional character-class random string generator — the mode you reach for when a target system enforces its own composition rules (must include a symbol, must be exactly 16 characters, no ambiguous characters) and you need to hit those constraints exactly.
Having all three in the same dialog means a technician doesn’t need to remember which external tool handles which format. Generating a service-account password for an API integration and a physical-console password for a switch use the same interface, just a different mode.
Workspace-Wide Defaults Keep Standards Consistent
Individual technician judgment on password strength varies — that’s true at every MSP, and it’s not really a training problem, it’s a human one. Weavestream lets admins set generator defaults workspace-wide from Admin → Settings: minimum length, which character classes are required, and word count for passphrase mode.
Once those defaults are set, every technician generating a credential starts from the same baseline instead of whatever length felt right in the moment. You’re not relying on everyone remembering “we do 20 characters minimum for admin accounts” — the generator opens with that already configured. It’s the kind of small policy-as-configuration detail that turns a documented standard into an enforced one.
Paired With a Real-Time Strength Meter
Whatever gets generated — or manually typed, since the vault doesn’t force you to use the generator — is scored live by zxcvbn-ts, the same strength-estimation approach used by major password managers. You get a 0–4 score (Very Weak to Very Strong), a plain-language warning when something’s off (“this is a top-10 common password,” for instance), and concrete suggestions for improving it.
This closes the gap that pure character-class rules leave open. A password can satisfy “12 characters, one symbol, one number” and still be trivially guessable. zxcvbn actually models how attackers guess — common substitutions, keyboard patterns, dictionary words — so the feedback reflects real-world crackability, not just a checkbox.
It Doesn’t Stop at Generation
A generated password isn’t just a one-time output — it becomes a normal Weavestream credential record from the moment it’s saved. That means it inherits everything else the vault does: AES-256-GCM encryption at rest, an immutable version history if it’s ever changed, a HaveIBeenPwned breach check run via k-anonymity lookup, and a full reveal audit trail every time someone decrypts it. The generator isn’t a separate utility bolted onto the vault — it’s the front door into the same credential lifecycle everything else in the vault goes through.
Why This Belongs in the Documentation Platform, Not a Browser Extension
Most MSPs generate passwords wherever is convenient in the moment — a browser’s built-in generator, a password manager’s extension, a quick web search for “random password generator.” None of those tools know anything about the credential’s context: which client it belongs to, which asset it protects, what your organisation’s minimum standards are for that tier of account.
Because Weavestream’s generator lives inside the same platform where the credential gets stored, linked to an asset, and eventually audited, there’s no handoff step where a strong password generated elsewhere gets pasted into a weaker system, or forgotten in a browser’s autofill history. Generation, storage, and policy enforcement happen in one place, on infrastructure you control.
Getting Started
If you’re already running Weavestream, open any password’s create or edit dialog and click the generator icon next to the password field. To set workspace-wide minimums, head to Admin → Settings and look for the password generator defaults.
New to Weavestream? The quickstart guide gets the full stack running with Docker Compose in a few minutes — the credential vault, generator included, works out of the box.