From ffc91025228cb53f1d4b04999d1eb95b59ea6b62 Mon Sep 17 00:00:00 2001
From: Leopere <colin@nixc.us>
Date: Sun, 8 Feb 2026 17:01:18 -0500
Subject: [PATCH] Default password length to 20 characters

20 is the recommended minimum for 2026. The API and UI still
accept shorter lengths if explicitly requested.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/index.html        | 4 ++--
 src/tools.html        | 4 ++--
 src/tools/password.rs | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/index.html b/src/index.html
index 016b3fc..23e5f26 100644
--- a/src/index.html
+++ b/src/index.html
@@ -370,7 +370,7 @@
         <div class="controls">
           <div class="field">
             <label for="pw-length">Length</label>
-            <input type="number" id="pw-length" value="16" min="1" max="128">
+            <input type="number" id="pw-length" value="20" min="1" max="128">
           </div>
           <div class="field">
             <label for="pw-charset">Charset</label>
@@ -657,7 +657,7 @@
       setToolsLoading(true);
       toolsOutput.textContent = 'Generating...';
       try {
-        const len = document.getElementById('pw-length').value || 16;
+        const len = document.getElementById('pw-length').value || 20;
         const cs = document.getElementById('pw-charset').value || 'alphanumeric';
         const noAmb = document.getElementById('pw-no-ambiguous').checked;
         let url = origin + '/password?length=' + len + '&charset=' + cs;
diff --git a/src/tools.html b/src/tools.html
index a6ef7f4..e2f32fa 100644
--- a/src/tools.html
+++ b/src/tools.html
@@ -134,7 +134,7 @@
     <div class="card">
       <h3>Quantum Password</h3>
       <div class="controls">
-        <div class="field"><label for="pw-length">Length</label><input type="number" id="pw-length" value="16" min="1" max="128"></div>
+        <div class="field"><label for="pw-length">Length</label><input type="number" id="pw-length" value="20" min="1" max="128"></div>
         <div class="field"><label for="pw-charset">Charset</label>
           <select id="pw-charset"><option value="alphanumeric">Alphanumeric</option><option value="full">Full (+ symbols)</option><option value="hex">Hex</option></select>
         </div>
@@ -250,7 +250,7 @@
     document.getElementById('btn-password').addEventListener('click', async () => {
       disableAll(true); outPw.className = 'output copyable loading'; outPw.textContent = 'Generating...';
       try {
-        const len = document.getElementById('pw-length').value || 16;
+        const len = document.getElementById('pw-length').value || 20;
         const cs = document.getElementById('pw-charset').value || 'alphanumeric';
         const noAmb = document.getElementById('pw-no-ambiguous').checked;
         let url = origin + '/password?length=' + len + '&charset=' + cs;
diff --git a/src/tools/password.rs b/src/tools/password.rs
index d65715e..b4a6a1d 100644
--- a/src/tools/password.rs
+++ b/src/tools/password.rs
@@ -3,7 +3,7 @@
 //! Configurable length and character set (lowercase, uppercase, digits, symbols).
 
 /// Default password length.
-pub const DEFAULT_LENGTH: usize = 16;
+pub const DEFAULT_LENGTH: usize = 20;
 
 /// Max length per request.
 pub const MAX_LENGTH: usize = 128;