# Password API
> A fast, fully-local password toolkit: generate cryptographically-secure random passwords (configurable length, character classes and exclude-similar), estimate password strength (entropy bits, a 0-4 score, character-class breakdown, common-password detection, an offline crack-time estimate and actionable feedback), and create memorable diceware-style passphrases. Built on Node crypto, no third-party upstream, and inputs are never logged — so responses are instant, private and always available. Ideal for signup and account flows, admin tools, password managers and security features.

## Authentication
All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys.

```bash
curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/password-api/..."
```

## Pricing
- **Free** (Free) — 7,000 calls/Mo, 3 req/s
- **Basic** ($5/Mo) — 130,000 calls/Mo, 12 req/s
- **Pro** ($16/Mo) — 800,000 calls/Mo, 35 req/s
- **Mega** ($44/Mo) — 4,500,000 calls/Mo, 120 req/s

## Endpoints

### Password

#### `GET /v1/generate` — Generate secure passwords

**Parameters:**
- `length` (query, optional, string) — Length 4-128 (default 16) Example: `16`
- `count` (query, optional, string) — How many 1-50 (default 1) Example: `1`
- `symbols` (query, optional, string) — Include symbols Example: `true`
- `exclude_similar` (query, optional, string) — Exclude il1Lo0O Example: `false`

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/password-api/v1/generate?length=16&count=1&symbols=true&exclude_similar=false"
```

**Response:**
```json
{
    "data": {
        "count": 1,
        "length": 16,
        "passwords": [
            "NxSHoS((%Ab?V&x["
        ],
        "pool_size": 88,
        "entropy_bits": 103.4
    },
    "meta": {
        "timestamp": "2026-05-30T09:00:25.055Z",
        "request_id": "823f21e0-7f5a-4b78-9850-dfb263c01e04"
    },
    "status": "ok",
    "message": "Passwords generated",
    "success": true
}
```

#### `GET /v1/passphrase` — Generate a passphrase

**Parameters:**
- `words` (query, optional, string) — Word count 2-12 (default 4) Example: `4`
- `separator` (query, optional, string) — Separator (default -) Example: `-`
- `capitalize` (query, optional, string) — Capitalize words Example: `false`
- `number` (query, optional, string) — Append a number Example: `false`

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/password-api/v1/passphrase?words=4&separator=-&capitalize=false&number=false"
```

**Response:**
```json
{
    "data": {
        "words": 4,
        "passphrase": "road-reed-wing-push",
        "entropy_bits": 36.9,
        "wordlist_size": 594
    },
    "meta": {
        "timestamp": "2026-05-30T09:00:25.128Z",
        "request_id": "4afe54ba-41c2-4068-ac66-37b770c70212"
    },
    "status": "ok",
    "message": "Passphrase generated",
    "success": true
}
```

#### `GET /v1/strength` — Estimate password strength

**Parameters:**
- `password` (query, required, string) — Password to score Example: `Tr0ub4dour&3`

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/password-api/v1/strength?password=Tr0ub4dour%263"
```

**Response:**
```json
{
    "data": {
        "label": "strong",
        "score": 3,
        "length": 12,
        "classes": {
            "numbers": true,
            "symbols": true,
            "lowercase": true,
            "uppercase": true
        },
        "feedback": [
            "Looks good"
        ],
        "is_common": false,
        "entropy_bits": 78.8,
        "crack_time_offline_fast": "999+ century"
    },
    "meta": {
        "timestamp": "2026-05-30T09:00:25.199Z",
        "request_id": "1c117147-74f5-46e7-9d31-ce78db08f535"
    },
    "status": "ok",
    "message": "Strength estimated",
    "success": true
}
```


---
Marketplace page: https://www.oanor.com/api/password-api
OpenAPI spec: https://www.oanor.com/api/password-api/openapi.json