Score a password's strength (0–4) with crack-time estimates and advice

Scores a password from 0 (very weak) to 4 (very strong), estimates how long it would take to crack, and gives tips to improve it.

Request

POSThttps://password-security-toolkit.p.apihiver.com/v1/strength

Media Type

JSON object. Required: password.

Request Body

Edit the values below to test different scenarios.

{
  "password": "Tr0ub4dor&3"
}

Parameters and body structure are inherited from this endpoint's definition. Changes here only apply to this test run.

Language

Client

1curl --request POST \
2  --url https://password-security-toolkit.p.apihiver.com/v1/strength \
3  --header 'Accept: application/json' \
4  --header 'Content-Type: application/json' \
5  --header 'X-API-Key: YOUR_API_KEY' \
6  --data '{
7  "password": "Tr0ub4dor&3"
8}'

Scores a password from 0 (very weak) to 4 (very strong), estimates how long it would take to crack, and gives tips to improve it. This endpoint is part of the Password Security API: Password strength scoring, private breach checks against known leaked passwords, secure password generation, hashing and bcrypt checks.

Score a password's strength (0–4) with crack-time estimates and advice: example requests in every language

POST /v1/strength in Shell (cURL)

curl --request POST \
  --url https://password-security-toolkit.p.apihiver.com/v1/strength \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --data '{
  "password": "Tr0ub4dor&3"
}'

POST /v1/strength in Shell (HTTPie)

echo '{
  "password": "Tr0ub4dor&3"
}' |  \
  http POST https://password-security-toolkit.p.apihiver.com/v1/strength \
  Accept:application/json \
  Content-Type:application/json \
  X-API-Key:YOUR_API_KEY

POST /v1/strength in Shell (Wget)

wget --quiet \
  --method POST \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --body-data '{\n  "password": "Tr0ub4dor&3"\n}' \
  --output-document \
  - https://password-security-toolkit.p.apihiver.com/v1/strength

POST /v1/strength in Node.js (http)

const http = require('https');

const options = {
  method: 'POST',
  hostname: 'password-security-toolkit.p.apihiver.com',
  port: null,
  path: '/v1/strength',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  }
};

const req = http.request(options, function (res) {
  const chunks = [];

  res.on('data', function (chunk) {
    chunks.push(chunk);
  });

  res.on('end', function () {
    const body = Buffer.concat(chunks);
    console.log(body.toString());
  });
});

req.write(JSON.stringify({password: 'Tr0ub4dor&3'}));
req.end();

POST /v1/strength in Node.js (Request)

const request = require('request');

const options = {
  method: 'POST',
  url: 'https://password-security-toolkit.p.apihiver.com/v1/strength',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  body: {password: 'Tr0ub4dor&3'},
  json: true
};

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});

POST /v1/strength in Node.js (Unirest)

const unirest = require('unirest');

const req = unirest('POST', 'https://password-security-toolkit.p.apihiver.com/v1/strength');

req.headers({
  'Content-Type': 'application/json',
  Accept: 'application/json',
  'X-API-Key': 'YOUR_API_KEY'
});

req.type('json');
req.send({
  password: 'Tr0ub4dor&3'
});

req.end(function (res) {
  if (res.error) throw new Error(res.error);

  console.log(res.body);
});

POST /v1/strength in Node.js (Axios)

const axios = require('axios').default;

const options = {
  method: 'POST',
  url: 'https://password-security-toolkit.p.apihiver.com/v1/strength',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  data: {password: 'Tr0ub4dor&3'}
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

POST /v1/strength in Node.js (Fetch)

const fetch = require('node-fetch');

const url = 'https://password-security-toolkit.p.apihiver.com/v1/strength';
const options = {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  body: '{"password":"Tr0ub4dor&3"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

POST /v1/strength in JavaScript (XMLHttpRequest)

const data = JSON.stringify({
  password: 'Tr0ub4dor&3'
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener('readystatechange', function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open('POST', 'https://password-security-toolkit.p.apihiver.com/v1/strength');
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.setRequestHeader('Accept', 'application/json');
xhr.setRequestHeader('X-API-Key', 'YOUR_API_KEY');

xhr.send(data);

POST /v1/strength in JavaScript (Axios)

import axios from 'axios';

const options = {
  method: 'POST',
  url: 'https://password-security-toolkit.p.apihiver.com/v1/strength',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  data: {password: 'Tr0ub4dor&3'}
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

POST /v1/strength in JavaScript (Fetch)

const url = 'https://password-security-toolkit.p.apihiver.com/v1/strength';
const options = {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  body: '{"password":"Tr0ub4dor&3"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

POST /v1/strength in JavaScript (jQuery)

const settings = {
  async: true,
  crossDomain: true,
  url: 'https://password-security-toolkit.p.apihiver.com/v1/strength',
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Accept: 'application/json',
    'X-API-Key': 'YOUR_API_KEY'
  },
  processData: false,
  data: '{\n  "password": "Tr0ub4dor&3"\n}'
};

$.ajax(settings).done(function (response) {
  console.log(response);
});

POST /v1/strength in Python (http.client)

import http.client

conn = http.client.HTTPSConnection("password-security-toolkit.p.apihiver.com")

payload = "{\n  \"password\": \"Tr0ub4dor&3\"\n}"

headers = {
    'Content-Type': "application/json",
    'Accept': "application/json",
    'X-API-Key': "YOUR_API_KEY"
}

conn.request("POST", "/v1/strength", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

POST /v1/strength in Python (Requests)

import requests

url = "https://password-security-toolkit.p.apihiver.com/v1/strength"

payload = { "password": "Tr0ub4dor&3" }
headers = {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "X-API-Key": "YOUR_API_KEY"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())

POST /v1/strength in PHP (cURL)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://password-security-toolkit.p.apihiver.com/v1/strength",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'password' => 'Tr0ub4dor&3'
  ]),
  CURLOPT_HTTPHEADER => [
    "Accept: application/json",
    "Content-Type: application/json",
    "X-API-Key: YOUR_API_KEY"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

POST /v1/strength in PHP (Guzzle)

<?php

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://password-security-toolkit.p.apihiver.com/v1/strength', [
  'body' => '{
  "password": "Tr0ub4dor&3"
}',
  'headers' => [
    'Accept' => 'application/json',
    'Content-Type' => 'application/json',
    'X-API-Key' => 'YOUR_API_KEY',
  ],
]);

echo $response->getBody();

POST /v1/strength in PHP (PECL HTTP v1)

<?php

$request = new HttpRequest();
$request->setUrl('https://password-security-toolkit.p.apihiver.com/v1/strength');
$request->setMethod(HTTP_METH_POST);

$request->setHeaders([
  'Content-Type' => 'application/json',
  'Accept' => 'application/json',
  'X-API-Key' => 'YOUR_API_KEY'
]);

$request->setContentType('application/json');
$request->setBody(json_encode([
  'password' => 'Tr0ub4dor&3'
]));

try {
  $response = $request->send();

  echo $response->getBody();
} catch (HttpException $ex) {
  echo $ex;
}

POST /v1/strength in PHP (PECL HTTP v2)

<?php

$client = new http\Client;
$request = new http\Client\Request;

$body = new http\Message\Body;
$body->append(json_encode([
  'password' => 'Tr0ub4dor&3'
]));
$request->setRequestUrl('https://password-security-toolkit.p.apihiver.com/v1/strength');
$request->setRequestMethod('POST');
$request->setBody($body);

$request->setHeaders([
  'Content-Type' => 'application/json',
  'Accept' => 'application/json',
  'X-API-Key' => 'YOUR_API_KEY'
]);

$client->enqueue($request)->send();
$response = $client->getResponse();

echo $response->getBody();

POST /v1/strength in Java (AsyncHttp)

AsyncHttpClient client = new DefaultAsyncHttpClient();
client.prepare("POST", "https://password-security-toolkit.p.apihiver.com/v1/strength")
  .setHeader("Content-Type", "application/json")
  .setHeader("Accept", "application/json")
  .setHeader("X-API-Key", "YOUR_API_KEY")
  .setBody("{\n  \"password\": \"Tr0ub4dor&3\"\n}")
  .execute()
  .toCompletableFuture()
  .thenAccept(System.out::println)
  .join();

client.close();

POST /v1/strength in Java (java.net.http)

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://password-security-toolkit.p.apihiver.com/v1/strength"))
    .header("Content-Type", "application/json")
    .header("Accept", "application/json")
    .header("X-API-Key", "YOUR_API_KEY")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"password\": \"Tr0ub4dor&3\"\n}"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

POST /v1/strength in Java (OkHttp)

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n  \"password\": \"Tr0ub4dor&3\"\n}");
Request request = new Request.Builder()
  .url("https://password-security-toolkit.p.apihiver.com/v1/strength")
  .post(body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Accept", "application/json")
  .addHeader("X-API-Key", "YOUR_API_KEY")
  .build();

Response response = client.newCall(request).execute();

POST /v1/strength in Java (Unirest)

HttpResponse<String> response = Unirest.post("https://password-security-toolkit.p.apihiver.com/v1/strength")
  .header("Content-Type", "application/json")
  .header("Accept", "application/json")
  .header("X-API-Key", "YOUR_API_KEY")
  .body("{\n  \"password\": \"Tr0ub4dor&3\"\n}")
  .asString();

POST /v1/strength in C# (HttpClient)

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    RequestUri = new Uri("https://password-security-toolkit.p.apihiver.com/v1/strength"),
    Headers =
    {
        { "Accept", "application/json" },
        { "X-API-Key", "YOUR_API_KEY" },
    },
    Content = new StringContent("{\n  \"password\": \"Tr0ub4dor&3\"\n}")
    {
        Headers =
        {
            ContentType = new MediaTypeHeaderValue("application/json")
        }
    }
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

POST /v1/strength in C# (RestSharp)

var client = new RestClient("https://password-security-toolkit.p.apihiver.com/v1/strength");
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Accept", "application/json");
request.AddHeader("X-API-Key", "YOUR_API_KEY");
request.AddParameter("application/json", "{\n  \"password\": \"Tr0ub4dor&3\"\n}", ParameterType.RequestBody);
var response = client.Execute(request);

POST /v1/strength in Go (NewRequest)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://password-security-toolkit.p.apihiver.com/v1/strength"

	payload := strings.NewReader("{\n  \"password\": \"Tr0ub4dor&3\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")
	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-API-Key", "YOUR_API_KEY")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

POST /v1/strength in Ruby (net::http)

require 'uri'
require 'net/http'

url = URI("https://password-security-toolkit.p.apihiver.com/v1/strength")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request["Accept"] = 'application/json'
request["X-API-Key"] = 'YOUR_API_KEY'
request.body = "{\n  \"password\": \"Tr0ub4dor&3\"\n}"

response = http.request(request)
puts response.read_body

POST /v1/strength in Swift (NSURLSession)

import Foundation

let headers = [
  "Content-Type": "application/json",
  "Accept": "application/json",
  "X-API-Key": "YOUR_API_KEY"
]
let parameters = ["password": "Tr0ub4dor&3"] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://password-security-toolkit.p.apihiver.com/v1/strength")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

POST /v1/strength in Objective-C (NSURLSession)

#import <Foundation/Foundation.h>

NSDictionary *headers = @{ @"Content-Type": @"application/json",
                           @"Accept": @"application/json",
                           @"X-API-Key": @"YOUR_API_KEY" };
NSDictionary *parameters = @{ @"password": @"Tr0ub4dor&3" };

NSData *postData = [NSJSONSerialization dataWithJSONObject:parameters options:0 error:nil];

NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://password-security-toolkit.p.apihiver.com/v1/strength"]
                                                       cachePolicy:NSURLRequestUseProtocolCachePolicy
                                                   timeoutInterval:10.0];
[request setHTTPMethod:@"POST"];
[request setAllHTTPHeaderFields:headers];
[request setHTTPBody:postData];

NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
                                            completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
                                                if (error) {
                                                    NSLog(@"%@", error);
                                                } else {
                                                    NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
                                                    NSLog(@"%@", httpResponse);
                                                }
                                            }];
[dataTask resume];

POST /v1/strength in Kotlin (OkHttp)

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"password\": \"Tr0ub4dor&3\"\n}")
val request = Request.Builder()
  .url("https://password-security-toolkit.p.apihiver.com/v1/strength")
  .post(body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Accept", "application/json")
  .addHeader("X-API-Key", "YOUR_API_KEY")
  .build()

val response = client.newCall(request).execute()

POST /v1/strength in C (libcurl)

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://password-security-toolkit.p.apihiver.com/v1/strength");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Content-Type: application/json");
headers = curl_slist_append(headers, "Accept: application/json");
headers = curl_slist_append(headers, "X-API-Key: YOUR_API_KEY");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\n  \"password\": \"Tr0ub4dor&3\"\n}");

CURLcode ret = curl_easy_perform(hnd);

POST /v1/strength in Clojure (clj-http)

(require '[clj-http.client :as client])

(client/post "https://password-security-toolkit.p.apihiver.com/v1/strength" {:headers {:X-API-Key "YOUR_API_KEY"}
                                                                             :content-type :json
                                                                             :form-params {:password "Tr0ub4dor&3"}
                                                                             :accept :json})

POST /v1/strength in OCaml (CoHTTP)

open Cohttp_lwt_unix
open Cohttp
open Lwt

let uri = Uri.of_string "https://password-security-toolkit.p.apihiver.com/v1/strength" in
let headers = Header.add_list (Header.init ()) [
  ("Content-Type", "application/json");
  ("Accept", "application/json");
  ("X-API-Key", "YOUR_API_KEY");
] in
let body = Cohttp_lwt_body.of_string "{\n  \"password\": \"Tr0ub4dor&3\"\n}" in

Client.call ~headers ~body `POST uri
>>= fun (res, body_stream) ->
  (* Do stuff with the result *)

POST /v1/strength in R (httr)

library(httr)

url <- "https://password-security-toolkit.p.apihiver.com/v1/strength"

payload <- "{\n  \"password\": \"Tr0ub4dor&3\"\n}"

encode <- "json"

response <- VERB("POST", url, body = payload, add_headers('X-API-Key' = 'YOUR_API_KEY'), content_type("application/json"), accept("application/json"), encode = encode)

content(response, "text")

POST /v1/strength in PowerShell (Invoke-WebRequest)

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("X-API-Key", "YOUR_API_KEY")
$response = Invoke-WebRequest -Uri 'https://password-security-toolkit.p.apihiver.com/v1/strength' -Method POST -Headers $headers -ContentType 'application/json' -Body '{
  "password": "Tr0ub4dor&3"
}'

POST /v1/strength in PowerShell (Invoke-RestMethod)

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("X-API-Key", "YOUR_API_KEY")
$response = Invoke-RestMethod -Uri 'https://password-security-toolkit.p.apihiver.com/v1/strength' -Method POST -Headers $headers -ContentType 'application/json' -Body '{
  "password": "Tr0ub4dor&3"
}'

POST /v1/strength in HTTP (HTTP/1.1)

POST /v1/strength HTTP/1.1
Content-Type: application/json
Accept: application/json
X-Api-Key: YOUR_API_KEY
Host: password-security-toolkit.p.apihiver.com
Content-Length: 31

{
  "password": "Tr0ub4dor&3"
}

Example response (200, application/json)

Success.

1{
2  "score": 4,
3  "length": 11,
4  "rating": "very strong",
5  "warning": null,
6  "crack_time": {
7    "online": "centuries",
8    "online_throttled": "centuries",
9    "offline_fast_hash": "10 seconds",
10    "offline_slow_hash": "4 months"
11  },
12  "suggestions": [],
13  "guesses_log10": 11
14}

Errors

400 — A required parameter is missing or a value has the wrong format.

1{
2  "error": {
3    "code": "INVALID_INPUT",
4    "message": "password: Field required"
5  }
6}

Gateway errors (missing key, no subscription, rate limits) are listed in Error codes.

Other Password Security API endpoints

Password Security API pricing →·Password Security API overview →