DEV Community

Daniel Igel
Daniel Igel

Posted on

Generate and validate passwords via REST API — CSPRNG, entropy scoring, and Diceware passphrases

Most auth flows generate passwords client-side, which means exposing the CSPRNG to the browser. Server-side generation via a one-call API keeps the randomness off-device and lets you enforce policies without duplicating logic across platforms.

One GET returns a cryptographically secure password:

curl "https://password-generator-strength-checker-api.p.rapidapi.com/api/v1/generate?length=20&symbols=true&excludeAmbiguous=true" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -H "x-rapidapi-host: password-generator-strength-checker-api.p.rapidapi.com"
Enter fullscreen mode Exit fullscreen mode

The response includes the password, its length, entropy in bits, and which character sets were active. excludeAmbiguous=true strips characters like 0, O, l, and 1 that look identical in most fonts — useful for passwords users will ever read aloud or type manually.

To score a candidate password your users submit, POST to /check:

const res = await fetch(
  'https://password-generator-strength-checker-api.p.rapidapi.com/api/v1/check',
  {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'x-rapidapi-key': process.env.RAPIDAPI_KEY,
      'x-rapidapi-host': 'password-generator-strength-checker-api.p.rapidapi.com',
    },
    body: JSON.stringify({ password: 'hunter2' }),
  }
);
const { score, strength, entropy, crackTime, weaknesses } = await res.json();
// score: 0–100, strength: "Very Weak" | "Weak" | "Fair" | "Strong" | "Very Strong"
Enter fullscreen mode Exit fullscreen mode

The checker detects common passwords, keyboard walks, sequential characters, and repeated patterns — returns a 0–100 score, entropy in bits, and a human-readable crack-time estimate.

Need passphrases instead? GET /api/v1/passphrase?words=4&separator=- returns a Diceware-style phrase. For bulk generation — onboarding flows, test fixtures — POST /api/v1/bulk accepts up to 100 passwords in one request. All endpoints run on Node.js built-in crypto, no third-party dependencies.

Free tier on RapidAPI: https://rapidapi.com/danieligel/api/password-generator-strength-checker-api

Do you enforce password strength at the API layer or leave that to the frontend?

Top comments (0)