@boringordinary/wordcode

Human-readable, crypto-secure verification codes. Three random words instead of six random digits.

maple-river-sunset

Why?

A 6-digit PIN has 1 million possible combinations. That sounds like a lot, but it's not — and it's hostile to humans. People misread digits, fumble between screens, and can't remember 482916 long enough to type it.

wordcode generates three common English words from a curated 1,000-word list. That's 1 billion combinations — 1,000x stronger than a 6-digit OTP — and you can actually remember maple-river-sunset while you switch tabs.

	6-digit PIN	3-word code
Combinations	1,000,000	1,000,000,000
Relative strength	1x	1,000x
Example	482916	maple-river-sunset
Memorable?	No	Yes
Easy to type?	Depends	Yes
Read aloud?	Awkward	Natural

Install

bun add @boringordinary/wordcode  # or npm, yarn, pnpm

Usage

import { generate } from "@boringordinary/wordcode";

generate();        // "maple-river-sunset"
generate(4);       // "maple-river-sunset-bold"
generate(2);       // "maple-river"
generate(3, " ");  // "maple river sunset"

With Better Auth

import { emailOTP } from "better-auth/plugins/email-otp";
import { generate } from "@boringordinary/wordcode";

emailOTP({
  generateOTP: generate,
  expiresIn: 300,
});

Access the word list

import { words } from "@boringordinary/wordcode";

console.log(words.length); // 1000

How it works

1. Picks count random indices using crypto.getRandomValues() (Web Crypto API)
2. Maps each index to a word from the 1,000-word list
3. Joins with the separator (default: -)

The word list is curated for:

• Readability — common English words, 3–7 letters, no jargon
• Memorability — concrete nouns, simple verbs, familiar adjectives
• Unambiguity — no homophones, no confusable spellings
• Safety — no offensive or sensitive words

Security

Words	Combinations	Equivalent PIN
2	1,000,000	6 digits
3	1,000,000,000	~10 digits
4	1,000,000,000,000	~13 digits

Three words is the sweet spot for OTPs: strong enough for any reasonable expiry window, easy enough to type without friction.

Uses crypto.getRandomValues() — available in Node.js, Bun, Deno, and all modern browsers. No custom PRNG, no Math.random().

License

MIT