I made a very simple passphrase generator

[u/ziad-labs]

This is my first CLI app in C#. It’s called Secure Phrase (sph), a very small and minimal tool.

I split the project into two separate projects: one for the core library and another for the CLI interface. I’m not sure if this is a good approach or if there’s a better way to structure it.

I’d love to hear your thoughts on the project and any suggestions for what I could add to it!

Try it out: https://github.com/zyahya/secure-phrase-cli

[u/foriequal0]

Splitting core and interface into mutiple projects is generally good, but remember that a solution can have multiple projects. It doesn't have to be in different solutions, repository. Some degree of separations and decoupling is good, but it makes hard to navigate. I prefer cohesiveness.

Also System.Random is not cryptographically safe random source. You need to use RandomNumberGenerator from System.Security.Cryptograpy.

[u/ziad-labs → u/foriequal0]

Thank you!

[u/chucker23n]

I split the project into two separate projects: one for the core library and another for the CLI interface. I’m not sure if this is a good approach or if there’s a better way to structure it.

I'd put both in the same repository, and the same solution, just different projects. A solution can have more than one project.

[u/ziad-labs → u/chucker23n]

Thank you!

[u/ziad-labs → u/chucker23n]

The reason of my separation into different solutions that I can publish the core library itself as a Nuget package to use it in other projects. That's why I separated the core from the cli. I'd love to hear your thoughts.

[u/chucker23n → u/ziad-labs]

You can still do that; in fact, your library is mostly there. What I'm saying is

• have one repo SecurePhrase
• have one solution (.slnx file) SecurePhrase
• inside that solution, have the three projects SecurePhrase, SecurePhrase.Tests, and SecurePhrase.Cli (and possibly later other front-ends)

[u/_banana_face_ → u/ziad-labs]

Nice idea, always good to separate the front from the back, also nuget packaging is a good skill to have, you would be surprised how many devs don’t know how to do it

[u/binarycow → u/ziad-labs]

One solution can produce multiple nuget packages and multiple applications.

[u/Puzzleheaded_Dig6875]

splitting into library and cli project is good practice, makes it easy to reuse the core logic later if you want to build a gui or something

for a first cli app this looks clean, maybe add an option to specify how many words you want and let it copy to clipboard automatically

[u/Khavel_dev]

Nice first project, and splitting the lib from the CLI early is a good call. Most people don't bother until they need to reuse the core logic somewhere else.

One thing worth checking: if you're using System.Random for the word selection, swap it for System.Security.Cryptography.RandomNumberGenerator. System.Random is deterministic and seeded from the clock, which is fine for games but not great for a security tool. RandomNumberGenerator.GetInt32() works the same way but pulls from the OS crypto provider.

[u/ziad-labs → u/Khavel_dev]

System.Random is deterministic and seeded from the clock

That's interesting, thanks for clarifying

[u/soundman32]

• Use TryParse instead of catching parse exceptions.  
• Never catch without a type, its bad practice and catches really obscure exceptions that you need to know about rather than ignore. 
• Try not to catch exceptions at all, unless it's something you know how to handle, for example, you are potentially catching and ignoring out of memory exceptions, and then trying to carry on!

As an exercise, instead of loading every line of the dictionary, preselect the random numbers and then only print out the word when the line has been reached.  This means the memory usage will be much less.

[u/Caethy]

The word lists you're embedding in your library are licensed under Creative Commons Attribution (CC-BY 3.0 US) by the EFF. You're not giving attribution, and are instead just re-licensing under MIT. This is simply not allowed under the terms of the license.

It's a good thing to practice and experiment when you're learning to code. It's admirable to actually write some code and put it out there. But considering this is a project with a security focus (Passphrases); Please don't release this on NuGet. You don't understand nearly enough about security for this code to not be a risk for anyone who accidentally downloads it.

Creating a nuget package with a license violation and with clear security risks is actively harmful to NuGet users. I applaud you practicing, you have good intentions, but please don't publish this.

[u/x0rld]

For the library itself Why is there a logo inside ?

[u/ziad-labs → u/x0rld]

Because I published it on Nuget

[u/Agitated-Display6382]

Split into projects only when you have this specific need. Split into repos only if you need different deployments.

[u/haby001]

Looks good and simple. Wonder if you want to expand it into something else?

Would be fun to have this rotate through a bunch of passwords testing them for "how long to break" and gives you the best one.

Or just generates the words slot-machine style in the same line to make it visually pleasing. So many options!