API

An API to generate and check passwords

api.password.es is answering. One request returns passwords and their analysis with the same numbers you see on this site: the same bits formula, the same attack model and the same level scale as the checker.

No sign-up and no key. You just call it: 60 requests per minute per IP. Generating works today; checking does not yet, and below we say exactly why.

What answers today

Everything hangs off https://api.password.es. Three endpoints answer and one does not yet; the full reference —parameters, fields and errors— lives in the documentation.

POST/v1/generate Generates one or several passwords and returns their analysis.
GET/openapi.json The description of the API, in OpenAPI 3.1.
POST/mcp MCP server for assistants. One tool: generate_password.
POST/v1/check 501 Does not exist yet. The error says what is missing and where to go meanwhile.

In ten seconds

No key, no sign-up and no headers. This is the whole call:

One password, nothing else

curl -X POST https://api.password.es/v1/generate

It returns a 16-character password and its analysis: the bits, how long it would hold up against an attack, and a level from 0 to 4 — the same numbers you see on this site's home page. Everything else is options.

The full reference

The API documentation has the nine parameters, every response field explained one by one, the error codes, the limits and how the answer language is chosen. That is the page you open next to your editor; this one is the page that says what it is.

What does not exist yet

No dates, because there are none. This is here so you can see where it is heading, not as a commitment.

/v1/check. The intention is that it analyses a password with the same numbers as the checker. Today it returns 501 and says why: it needs the very same pattern engine as the web, and that costs between 11 ms and 3.6 s of CPU per request depending on the input. It is waiting on a decision —where to put the length cap— that has not been taken yet.
Checking by k-anonymity: finding out whether a password appears in a breach without ever sending the whole thing.
The local package: the same engine to run on your own machine and never call us at all. It is the expensive part of all this, so do not count on it.
Keys and plans. No date and no commitment. There is no sign-up and no pricing today, which is why there is not a single link to either anywhere in the API — not even in the rate-limit error.

What we will not hide

An API that generates passwords is, at heart, an antipattern: the password travels over the network and passes through a machine that is not yours. Now that it can actually be called is when this warning is needed, not back when this page was a promise.

So it does not live only here: every response carries its own notice saying the same thing, in the language you ask for. For a password you will actually use, this site's generator runs entirely in your browser and sends nothing; the checker likewise.

The real way out of this antipattern is the local package in the list above: the same engine, on your machine, with us out of the middle. An intention, not a date.