# カギバコ (https://kagi.mediabako.com)

> Password, passphrase and identifier generation that runs entirely in the
> visitor's browser. A curl-able HTTP API is available for throwaway values.

All generator pages run in the browser and send nothing to a server. Draws use
rejection sampling, so no character or word is more likely than another.

## HTTP API

Plain text by default, one value per line, trailing newline. No auth, no cookies,
CORS open to all origins. Rate limited to 60 requests per minute per IP.

    curl https://kagi.mediabako.com/api/password
    curl 'https://kagi.mediabako.com/api/password?len=32&symbols=1&count=5'
    curl 'https://kagi.mediabako.com/api/passphrase?words=6&sep=-'
    curl 'https://kagi.mediabako.com/api/uuid?v=7&count=10'
    curl https://kagi.mediabako.com/api            # plain-text usage

- /api/password  — len 4-128 (20), count 1-20 (1), upper/lower/digits/symbols 0|1,
  urlsafe 0|1, ambiguous 1 to exclude look-alikes, format plain|json
- /api/passphrase — words 3-12 (6), sep (-), capitalize 0|1, digits 0-4, count, format
- /api/uuid — v 4|7|ulid (4), count 1-100 (1), format

Machine-readable definition: https://kagi.mediabako.com/openapi.json

## Important limitation

The API generates values on the server and returns them over the network, so
they pass through the server and the network path. Use it for throwaway test
data, CI fixtures and scratch accounts. For real credentials, generate locally:

    LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo

Full explanation, with equivalents for openssl, Python and PowerShell:
https://kagi.mediabako.com/en/cli/

## Pages

- https://kagi.mediabako.com/ — password generator (Japanese)
- https://kagi.mediabako.com/passphrase/ — passphrase generator, EFF long wordlist, 12.925 bits/word
- https://kagi.mediabako.com/pin/ — numeric PIN
- https://kagi.mediabako.com/cli/ — command-line one-liners and API reference (Japanese)
- https://kagi.mediabako.com/en/cli/ — the same page in English
- https://kagi.mediabako.com/strict/ — the generator on a page whose Content-Security-Policy sets
  connect-src 'none', so the browser forbids it from making any request at all