Password Strength & Breach Check API

Score a password 0–4 with crack-time estimates and advice, and check whether it appears in known data breaches without ever sending it (k-anonymity).

Parameters

Example

curl -X POST "https://apibox.io.vn/v1/password-check" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"anhyeuem2024"}'

const res = await fetch('https://apibox.io.vn/v1/password-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "password": "anhyeuem2024"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/password-check",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"password": "anhyeuem2024"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/password-check');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"password":"anhyeuem2024"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "length": 12,
  "charsets": {
    "lower": true,
    "upper": false,
    "digits": true,
    "symbols": false,
    "unicode": false
  },
  "entropy_bits": 10,
  "score": 0,
  "strength": "very weak",
  "crack_time": {
    "online_throttled": "5 hours",
    "online": "51 seconds",
    "offline_slow_hash": "less than a second",
    "offline_fast_hash": "less than a second"
  },
  "warnings": [
    "This password appeared … times in known data breaches: never use it",
    "A common password with a few characters added is still easy to guess",
    "Dates and years (birthdays) are among the first things attackers try"
  ],
  "suggestions": [
    "Mixing character types helps, but length helps more",
    "Use a different password for every site, ideally from a password manager"
  ],
  "breach": {
    "checked": true,
    "found": true,
    "count": 1234
  },
  "note": "The password is not stored or logged. …"
}

Use cases

• Password meters on sign-up and change-password forms
• Block breached passwords as NIST SP 800-63B recommends
• Security audits of admin accounts
• Teach users what makes a password strong

FAQ

Related APIs