Sept 2, 2017 Release
Many new changes:
- All JavaScript and CSS is now taking advantage of subresource integrity (SRI) using SHA-256. If you install this generator on a CDN, this will help ensure that the data being delivered as what it should be.
- In order to accommodate for the previous item, every list is downloaded on page load. Most of these are done asynchronously to speed up page load. However, the initial page load may be noticeably slow.
- A great deal of orphaned JavaScript code was cleaned out as a result of the previous item.
- Each word list, because there are largely static, were renamed adding the SHA-224 hash of the file to the filename. This makes it possible to configure your web server with exceptionally long expiration times, so the client browser can keep a cache of every word list, provided the filename does not change. While the initial page load may be slow, additional page loads should be snappy.
- The Emoji box was combined with the Random box, making way for the Bitcoin box.
- The Bitcoin passphrase generator was pulled from the Alternate box, and into its own box.
- The Bitcoin box now supports the following languages from bip-0039:
- Chinese (Simplified)
- Chinese (Traditional)
- English (default)
- French
- Italian
- Japanese
- Korean
- Spanish
- Because I am now using SRI, which has about 70% browser support, I decided to drop the SJCL JavaScript library, and rely on the Web Crypto API for all random number generation. This means more obscure browsers, such as
surf(1)
may not generate any passphrases. Sorry.
Because of the size of the download for this project, it is recommended to configure compression with your web server, such as mod_deflate
in Apache. By doing so, I see on average, about 70% compression ratios. I'm still debating if I want to offer manually gzipped compressed JavaScript word lists, or just rely on the backend web server configuration for compression. Right now, I'm leaning toward the latter.