Free Strong Password Generator Online

Q: Can I generate passwords without symbols?

Yes: symbols=false. You can also disable lowercase, uppercase or numbers, and add exclude_ambiguous=true for passwords that are easy to read aloud or type.

Generate cryptographically secure random passwords (4–256 chars, up to 100 at once) or check a password’s strength, entropy and estimated crack time.

Result

Press “Run” to see the result.

The Password API does two jobs. Without a password parameter it generates random passwords using the platform’s cryptographically secure random generator: choose the length (4–256, default 16), how many to create with count (1–100), and which character sets to include – lowercase, uppercase, numbers, symbols (all on by default; set one to false to drop it). exclude_ambiguous=true removes look-alike characters such as O, 0, I, l and 1.

With password=... it checks the strength of an existing password instead: you get a score from 0 to 4 with a label (very weak … very strong), the entropy in bits, an estimated offline crack time at 10 billion guesses per second, and a list of issues such as "shorter than 8 characters", "a very common password", repeated characters, common sequences or missing character classes.

Generated passwords are also returned with the strength report of the first one. Nothing is stored or logged by the endpoint. For checking sensitive passwords prefer POST so the value does not end up in URLs.

Use this in your code

curl "https://apibox.io.vn/v1/password?length=20&count=2" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/password?length=20&count=2', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/password?length=20&count=2",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/password?length=20&count=2');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Are the generated passwords truly random?

Yes. They are drawn from crypto.getRandomValues (a CSPRNG) on Cloudflare Workers, not from Math.random, and are never stored.

How is the strength score calculated?

Entropy = length × log2(size of the character pool used). The score goes from 0 (<28 bits) to 4 (≥80 bits), is forced to 0 for very common passwords and capped at 2 when three or more issues are found.

Can I generate passwords without symbols?

Yes: symbols=false. You can also disable lowercase, uppercase or numbers, and add exclude_ambiguous=true for passwords that are easy to read aloud or type.