Password Strength Checker

Score a password 0–4 with crack-time estimates and advice, and check whether it appears in known data breaches without ever sending it (k-anonymity).

Result

Press “Run” to see the result.

The password check API estimates how hard a password is to guess. Beyond length and character types it looks for what attackers try first: the most common passwords (including Vietnamese favourites such as matkhau or anhyeuem), common passwords with digits added, keyboard and alphabet sequences (qwerty, 1234, abcd), repeated characters, l33t substitutions (P@ssw0rd) and dates or years. It returns a score from 0 (very weak) to 4 (very strong), the estimated entropy, crack times for four attack scenarios and warnings and suggestions you can show next to a sign-up form.

It also checks the password against the Have I Been Pwned database of more than 900 million breached passwords. Only the first 5 characters of the SHA-1 hash leave our server (k-anonymity range search, with padding), so neither we nor HIBP learn the password; a breached password always scores 0. Set breach=false to skip this step.

The password is processed in memory only: it is not stored, logged or used as a cache key. Send it in a POST body rather than in the URL.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/password-check" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"anhyeuem2024"}'

const res = await fetch('https://apibox.io.vn/v1/password-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "password": "anhyeuem2024"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/password-check",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"password": "anhyeuem2024"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/password-check');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"password":"anhyeuem2024"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Is my password sent to Have I Been Pwned?

No. Only the first 5 hex characters of its SHA-1 hash are sent; the API compares the rest locally against the returned list.

Why does a long passphrase score 0?

Because it appeared in breaches (e.g. “correct horse battery staple”). Attackers try known leaked passwords first, whatever their length.

Should I require symbols?

Length matters more. Current guidance is a minimum of 8 (better 12+) characters, no composition rules, and a breach check — which this API gives you.