Generate strong random passwords
Generates cryptographically secure random passwords, with their entropy in bits.
Request
GEThttps://password-security-toolkit.p.apihiver.com/v1/generate?length=16
Number. Password length (8–128, default
16). Number. How many passwords to generate (1–50, default
1). Boolean. Include upper-case letters (default
true). Boolean. Include digits (default
true). Boolean. Include symbols (default
true). Boolean. Leave out look-alikes like 0/O and l/1 (default
false). Language
Client
1curl --request GET \
2 --url 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D' \
3 --header 'Accept: application/json' \
4 --header 'X-API-Key: YOUR_API_KEY'Generate strong random passwords: Password Security API reference
Generates cryptographically secure random passwords, with their entropy in bits. This endpoint is part of the Password Security API: Password strength scoring, private breach checks against known leaked passwords, secure password generation, hashing and bcrypt checks.
Generate strong random passwords: example requests in every language
GET /v1/generate in Shell (cURL)
curl --request GET \
--url 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D' \
--header 'Accept: application/json' \
--header 'X-API-Key: YOUR_API_KEY'GET /v1/generate in Shell (HTTPie)
http GET 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D' \
Accept:application/json \
X-API-Key:YOUR_API_KEYGET /v1/generate in Shell (Wget)
wget --quiet \
--method GET \
--header 'Accept: application/json' \
--header 'X-API-Key: YOUR_API_KEY' \
--output-document \
- 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D'GET /v1/generate in Node.js (http)
const http = require('https');
const options = {
method: 'GET',
hostname: 'password-security-toolkit.p.apihiver.com',
port: null,
path: '/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D',
headers: {
Accept: 'application/json',
'X-API-Key': 'YOUR_API_KEY'
}
};
const req = http.request(options, function (res) {
const chunks = [];
res.on('data', function (chunk) {
chunks.push(chunk);
});
res.on('end', function () {
const body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.end();GET /v1/generate in Node.js (Request)
const request = require('request');
const options = {
method: 'GET',
url: 'https://password-security-toolkit.p.apihiver.com/v1/generate',
qs: {
length: '16',
count: '{count}',
uppercase: '{uppercase}',
digits: '{digits}',
symbols: '{symbols}',
exclude_ambiguous: '{exclude_ambiguous}'
},
headers: {Accept: 'application/json', 'X-API-Key': 'YOUR_API_KEY'}
};
request(options, function (error, response, body) {
if (error) throw new Error(error);
console.log(body);
});GET /v1/generate in Node.js (Unirest)
const unirest = require('unirest');
const req = unirest('GET', 'https://password-security-toolkit.p.apihiver.com/v1/generate');
req.query({
length: '16',
count: '{count}',
uppercase: '{uppercase}',
digits: '{digits}',
symbols: '{symbols}',
exclude_ambiguous: '{exclude_ambiguous}'
});
req.headers({
Accept: 'application/json',
'X-API-Key': 'YOUR_API_KEY'
});
req.end(function (res) {
if (res.error) throw new Error(res.error);
console.log(res.body);
});GET /v1/generate in Node.js (Axios)
const axios = require('axios').default;
const options = {
method: 'GET',
url: 'https://password-security-toolkit.p.apihiver.com/v1/generate',
params: {
length: '16',
count: '{count}',
uppercase: '{uppercase}',
digits: '{digits}',
symbols: '{symbols}',
exclude_ambiguous: '{exclude_ambiguous}'
},
headers: {Accept: 'application/json', 'X-API-Key': 'YOUR_API_KEY'}
};
try {
const { data } = await axios.request(options);
console.log(data);
} catch (error) {
console.error(error);
}GET /v1/generate in Node.js (Fetch)
const fetch = require('node-fetch');
const url = 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D';
const options = {
method: 'GET',
headers: {Accept: 'application/json', 'X-API-Key': 'YOUR_API_KEY'}
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}GET /v1/generate in JavaScript (XMLHttpRequest)
const data = null;
const xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.addEventListener('readystatechange', function () {
if (this.readyState === this.DONE) {
console.log(this.responseText);
}
});
xhr.open('GET', 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D');
xhr.setRequestHeader('Accept', 'application/json');
xhr.setRequestHeader('X-API-Key', 'YOUR_API_KEY');
xhr.send(data);GET /v1/generate in JavaScript (Axios)
import axios from 'axios';
const options = {
method: 'GET',
url: 'https://password-security-toolkit.p.apihiver.com/v1/generate',
params: {
length: '16',
count: '{count}',
uppercase: '{uppercase}',
digits: '{digits}',
symbols: '{symbols}',
exclude_ambiguous: '{exclude_ambiguous}'
},
headers: {Accept: 'application/json', 'X-API-Key': 'YOUR_API_KEY'}
};
try {
const { data } = await axios.request(options);
console.log(data);
} catch (error) {
console.error(error);
}GET /v1/generate in JavaScript (Fetch)
const url = 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D';
const options = {
method: 'GET',
headers: {Accept: 'application/json', 'X-API-Key': 'YOUR_API_KEY'}
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}GET /v1/generate in JavaScript (jQuery)
const settings = {
async: true,
crossDomain: true,
url: 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D',
method: 'GET',
headers: {
Accept: 'application/json',
'X-API-Key': 'YOUR_API_KEY'
}
};
$.ajax(settings).done(function (response) {
console.log(response);
});GET /v1/generate in Python (http.client)
import http.client
conn = http.client.HTTPSConnection("password-security-toolkit.p.apihiver.com")
headers = {
'Accept': "application/json",
'X-API-Key': "YOUR_API_KEY"
}
conn.request("GET", "/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D", headers=headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))GET /v1/generate in Python (Requests)
import requests
url = "https://password-security-toolkit.p.apihiver.com/v1/generate"
querystring = {"length":"16","count":"{count}","uppercase":"{uppercase}","digits":"{digits}","symbols":"{symbols}","exclude_ambiguous":"{exclude_ambiguous}"}
headers = {
"Accept": "application/json",
"X-API-Key": "YOUR_API_KEY"
}
response = requests.get(url, headers=headers, params=querystring)
print(response.json())GET /v1/generate in PHP (cURL)
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Accept: application/json",
"X-API-Key: YOUR_API_KEY"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}GET /v1/generate in PHP (Guzzle)
<?php
$client = new \GuzzleHttp\Client();
$response = $client->request('GET', 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D', [
'headers' => [
'Accept' => 'application/json',
'X-API-Key' => 'YOUR_API_KEY',
],
]);
echo $response->getBody();GET /v1/generate in PHP (PECL HTTP v1)
<?php
$request = new HttpRequest();
$request->setUrl('https://password-security-toolkit.p.apihiver.com/v1/generate');
$request->setMethod(HTTP_METH_GET);
$request->setQueryData([
'length' => '16',
'count' => '{count}',
'uppercase' => '{uppercase}',
'digits' => '{digits}',
'symbols' => '{symbols}',
'exclude_ambiguous' => '{exclude_ambiguous}'
]);
$request->setHeaders([
'Accept' => 'application/json',
'X-API-Key' => 'YOUR_API_KEY'
]);
try {
$response = $request->send();
echo $response->getBody();
} catch (HttpException $ex) {
echo $ex;
}GET /v1/generate in PHP (PECL HTTP v2)
<?php
$client = new http\Client;
$request = new http\Client\Request;
$request->setRequestUrl('https://password-security-toolkit.p.apihiver.com/v1/generate');
$request->setRequestMethod('GET');
$request->setQuery(new http\QueryString([
'length' => '16',
'count' => '{count}',
'uppercase' => '{uppercase}',
'digits' => '{digits}',
'symbols' => '{symbols}',
'exclude_ambiguous' => '{exclude_ambiguous}'
]));
$request->setHeaders([
'Accept' => 'application/json',
'X-API-Key' => 'YOUR_API_KEY'
]);
$client->enqueue($request)->send();
$response = $client->getResponse();
echo $response->getBody();GET /v1/generate in Java (AsyncHttp)
AsyncHttpClient client = new DefaultAsyncHttpClient();
client.prepare("GET", "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")
.setHeader("Accept", "application/json")
.setHeader("X-API-Key", "YOUR_API_KEY")
.execute()
.toCompletableFuture()
.thenAccept(System.out::println)
.join();
client.close();GET /v1/generate in Java (java.net.http)
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D"))
.header("Accept", "application/json")
.header("X-API-Key", "YOUR_API_KEY")
.method("GET", HttpRequest.BodyPublishers.noBody())
.build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());GET /v1/generate in Java (OkHttp)
OkHttpClient client = new OkHttpClient();
Request request = new Request.Builder()
.url("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")
.get()
.addHeader("Accept", "application/json")
.addHeader("X-API-Key", "YOUR_API_KEY")
.build();
Response response = client.newCall(request).execute();GET /v1/generate in Java (Unirest)
HttpResponse<String> response = Unirest.get("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")
.header("Accept", "application/json")
.header("X-API-Key", "YOUR_API_KEY")
.asString();GET /v1/generate in C# (HttpClient)
using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
Method = HttpMethod.Get,
RequestUri = new Uri("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D"),
Headers =
{
{ "Accept", "application/json" },
{ "X-API-Key", "YOUR_API_KEY" },
},
};
using (var response = await client.SendAsync(request))
{
response.EnsureSuccessStatusCode();
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
}GET /v1/generate in C# (RestSharp)
var client = new RestClient("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D");
var request = new RestRequest("", Method.Get);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-API-Key", "YOUR_API_KEY");
var response = client.Execute(request);GET /v1/generate in Go (NewRequest)
package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Accept", "application/json")
req.Header.Add("X-API-Key", "YOUR_API_KEY")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}GET /v1/generate in Ruby (net::http)
require 'uri'
require 'net/http'
url = URI("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-API-Key"] = 'YOUR_API_KEY'
response = http.request(request)
puts response.read_bodyGET /v1/generate in Swift (NSURLSession)
import Foundation
let headers = [
"Accept": "application/json",
"X-API-Key": "YOUR_API_KEY"
]
let request = NSMutableURLRequest(url: NSURL(string: "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")! as URL,
cachePolicy: .useProtocolCachePolicy,
timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers
let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
if (error != nil) {
print(error as Any)
} else {
let httpResponse = response as? HTTPURLResponse
print(httpResponse)
}
})
dataTask.resume()GET /v1/generate in Objective-C (NSURLSession)
#import <Foundation/Foundation.h>
NSDictionary *headers = @{ @"Accept": @"application/json",
@"X-API-Key": @"YOUR_API_KEY" };
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D"]
cachePolicy:NSURLRequestUseProtocolCachePolicy
timeoutInterval:10.0];
[request setHTTPMethod:@"GET"];
[request setAllHTTPHeaderFields:headers];
NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
if (error) {
NSLog(@"%@", error);
} else {
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
NSLog(@"%@", httpResponse);
}
}];
[dataTask resume];GET /v1/generate in Kotlin (OkHttp)
val client = OkHttpClient()
val request = Request.Builder()
.url("https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D")
.get()
.addHeader("Accept", "application/json")
.addHeader("X-API-Key", "YOUR_API_KEY")
.build()
val response = client.newCall(request).execute()GET /v1/generate in C (libcurl)
CURL *hnd = curl_easy_init();
curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "GET");
curl_easy_setopt(hnd, CURLOPT_URL, "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D");
struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Accept: application/json");
headers = curl_slist_append(headers, "X-API-Key: YOUR_API_KEY");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);
CURLcode ret = curl_easy_perform(hnd);GET /v1/generate in Clojure (clj-http)
(require '[clj-http.client :as client])
(client/get "https://password-security-toolkit.p.apihiver.com/v1/generate" {:headers {:X-API-Key "YOUR_API_KEY"}
:query-params {:length "16"
:count "{count}"
:uppercase "{uppercase}"
:digits "{digits}"
:symbols "{symbols}"
:exclude_ambiguous "{exclude_ambiguous}"}
:accept :json})GET /v1/generate in OCaml (CoHTTP)
open Cohttp_lwt_unix
open Cohttp
open Lwt
let uri = Uri.of_string "https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D" in
let headers = Header.add_list (Header.init ()) [
("Accept", "application/json");
("X-API-Key", "YOUR_API_KEY");
] in
Client.call ~headers `GET uri
>>= fun (res, body_stream) ->
(* Do stuff with the result *)GET /v1/generate in R (httr)
library(httr)
url <- "https://password-security-toolkit.p.apihiver.com/v1/generate"
queryString <- list(
length = "16",
count = "{count}",
uppercase = "{uppercase}",
digits = "{digits}",
symbols = "{symbols}",
exclude_ambiguous = "{exclude_ambiguous}"
)
response <- VERB("GET", url, query = queryString, add_headers('X-API-Key' = 'YOUR_API_KEY'), content_type(""), accept("application/json"))
content(response, "text")GET /v1/generate in PowerShell (Invoke-WebRequest)
$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("X-API-Key", "YOUR_API_KEY")
$response = Invoke-WebRequest -Uri 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D' -Method GET -Headers $headersGET /v1/generate in PowerShell (Invoke-RestMethod)
$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("X-API-Key", "YOUR_API_KEY")
$response = Invoke-RestMethod -Uri 'https://password-security-toolkit.p.apihiver.com/v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D' -Method GET -Headers $headersGET /v1/generate in HTTP (HTTP/1.1)
GET /v1/generate?length=16&count=%7Bcount%7D&uppercase=%7Buppercase%7D&digits=%7Bdigits%7D&symbols=%7Bsymbols%7D&exclude_ambiguous=%7Bexclude_ambiguous%7D HTTP/1.1
Accept: application/json
X-Api-Key: YOUR_API_KEY
Host: password-security-toolkit.p.apihiver.com
Example response (200, application/json)
Success.
1{
2 "length": 16,
3 "passwords": [
4 "@0xa2;?ImKU;34D6"
5 ],
6 "entropy_bits": 102.6
7}Errors
- 400 — A required parameter is missing or a value has the wrong format.
1{ 2 "error": { 3 "code": "INVALID_INPUT", 4 "message": "A parameter has the wrong format — the message names it." 5 } 6}
Gateway errors (missing key, no subscription, rate limits) are listed in Error codes.
Other Password Security API endpoints
- POSTScore a password's strength (0–4) with crack-time estimates and advice
- POSTHas this password appeared in known data breaches?
- POSTHash text (MD5/SHA/BLAKE2/bcrypt)
- POSTCheck text against a bcrypt hash
Password Security API pricing →·Password Security API overview →