Password Generator API

Q: Can I generate passwords without symbols?

Yes: symbols=false. You can also disable lowercase, uppercase or numbers, and add exclude_ambiguous=true for passwords that are easy to read aloud or type.

Generate cryptographically secure random passwords (4–256 chars, up to 100 at once) or check a password’s strength, entropy and estimated crack time.

GETPOSThttps://apibox.io.vn/v1/password

Security & Crypto▶ Try it online

The Password API does two jobs. Without a password parameter it generates random passwords using the platform’s cryptographically secure random generator: choose the length (4–256, default 16), how many to create with count (1–100), and which character sets to include – lowercase, uppercase, numbers, symbols (all on by default; set one to false to drop it). exclude_ambiguous=true removes look-alike characters such as O, 0, I, l and 1.

With password=... it checks the strength of an existing password instead: you get a score from 0 to 4 with a label (very weak … very strong), the entropy in bits, an estimated offline crack time at 10 billion guesses per second, and a list of issues such as "shorter than 8 characters", "a very common password", repeated characters, common sequences or missing character classes.

Generated passwords are also returned with the strength report of the first one. Nothing is stored or logged by the endpoint. For checking sensitive passwords prefer POST so the value does not end up in URLs.

Parameters

Name	In	Type	Required	Default
`length`	body\|query	number	no	`16`	Password length, 4–256.
`count`	body\|query	number	no	`1`	Number of passwords, 1–100.
`lowercase`	body\|query	boolean	no	`true`	Include a–z.
`uppercase`	body\|query	boolean	no	`true`	Include A–Z.
`numbers`	body\|query	boolean	no	`true`	Include 0–9.
`symbols`	body\|query	boolean	no	`true`	Include symbols !@#$%^&*()-_=+[]{};:,.?/~
`exclude_ambiguous`	body\|query	boolean	no	`false`	Remove look-alike characters (O 0 I l 1).
`password`	body\|query	string	no		Check this password’s strength instead of generating new ones.

Example

curl "https://apibox.io.vn/v1/password?length=20&count=2" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/password?length=20&count=2', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/password?length=20&count=2",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/password?length=20&count=2');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "length": 20,
  "count": 2,
  "passwords": [
    "6y4#_r8i[}rNJFuHb=e4",
    "%@:$yMsZyAa^veIM6K@h"
  ],
  "strength": {
    "score": 4,
    "label": "very strong",
    "entropy_bits": 131.4,
    "crack_time_offline": "centuries",
    "issues": []
  }
}

Use cases

Create initial passwords for new user accounts or invites
Generate API secrets, Wi-Fi keys and database passwords in scripts
Show a password strength meter in a sign-up form
Audit imported passwords against common-password and length rules

FAQ

Are the generated passwords truly random?

Yes. They are drawn from crypto.getRandomValues (a CSPRNG) on Cloudflare Workers, not from Math.random, and are never stored.

How is the strength score calculated?

Entropy = length × log2(size of the character pool used). The score goes from 0 (<28 bits) to 4 (≥80 bits), is forced to 0 for very common passwords and capped at 2 when three or more issues are found.

Can I generate passwords without symbols?

Yes: symbols=false. You can also disable lowercase, uppercase or numbers, and add exclude_ambiguous=true for passwords that are easy to read aloud or type.

Password Generator API

Parameters

Example

Response

Use cases

FAQ

Related APIs

Hash Generator

Encode / Decode

JWT Decode & Sign