MD5 password file generator for demonstrating john the ripper

index.js

import { cryptMD5 } from 'cryptmd5';
import { appendFile } from 'fs';

const pwPerFile = 5;

function writeFile(pwSize) {
    const filename = `pwLen${pwSize}.txt`;
    console.log(`starting ${filename}`);
    for (let i = 0; i < pwPerFile; i++) {    
        const password = passwordOf(pwSize);
        const hash = cryptMD5(password, 'erXgIjX7')
        console.log(`generated pw '${password}' and hash ${hash}`);
        
        appendFile(filename, hash + '\n', function (err) {
          if (err) {
            console.error(`could not write ${hash} to ${filename}`);
            console.log(err);
          } else {
            console.log('appended to file')
          }
        })
    }
    console.log(`finished writing to ${filename}`);
}

function passwordOf(len) {
    let res           = '';
    const chars       = 'abcdefghijklmnopqrstuvwxyz';
    const charsAvailable = chars.length;
    for (let i = 0; i < len; i++) {
       res += chars.charAt(Math.floor(Math.random() * charsAvailable));
    }
    return res;
}

writeFile(1);
writeFile(2);
writeFile(3);
writeFile(4);

launch.json

{
    "version": "0.2.0",
    "configurations": [
        {
            "type": "pwa-node",
            "request": "launch",
            "name": "Launch Program",
            "skipFiles": [
                "<node_internals>/**"
            ],
            "program": "${workspaceFolder}/index.js"
        }
    ]
}

package.json

{
  "name": "genmd5",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "type": "module",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "cryptmd5": "^0.1.2"
  }
}

Please be aware that this is designed to make passwords crackable in the blink of an eye--NOT passwords for actual use. Demonstrations of cracking tools is virtually the only good use of MD5. Last I checked, MD5 was only broken for collisions and technically isn't pre-image resistant, but it will still show red flags to pen testers and auditors. Also, if you need to look up first pre-image vs second pre-image vs collision resistance, you probably shouldn't consider MD5 anyway.