Password Strength Checker API

Estimate a password's strength like zxcvbn: entropy in bits, a 0–4 score, detected weak patterns (common passwords, sequences, keyboard runs, dates, repeats), estimated crack times and suggestions.

POST /api/v1/tools/password-strength-checkerMCP password_strength_checkerSecurity & Privacy

Estimate how strong a password is, how long it could take to crack, and how to improve it. Spots common passwords and patterns. Nothing is sent or stored.

Input

Send these as a JSON object. Unknown fields are rejected.

password: The password to analyse. Avoid sending passwords that are in real use. (string, up to 1000 characters, required)

Try it in the browser JSON Schema Get an API key

curl https://pithlab.com/api/v1/tools/password-strength-checker \n  -H "Authorization: Bearer $PITHLAB_KEY" \n  -H "Content-Type: application/json" \n  -d '{"password":"Summer2024!"}'

Example response

{
  "ok": true,
  "result": {
    "score": 0,
    "label": "Very weak",
    "bits": 21.102455047003932,
    "bruteForceBits": 72.26841169164042,
    "length": 11,
    "classes": {
      "lowercase": true,
      "uppercase": true,
      "digits": true,
      "symbols": true,
      "other": false
    },
    "warning": "Contains a very common password or word (\"Summer\").",
    "suggestions": [
      "Make it longer: aim for at least 12 characters, or 16 or more for important accounts. Length adds more strength than symbols.",
      "Avoid common passwords and words, even with capitals, added numbers or symbols.",
      "Avoid dates and years such as \"2024\"; birthdays and anniversaries are easy to guess.",
      "Try a passphrase of four or more random, unrelated words, or let a password manager generate a password for you."
    ],
    "patterns": [
      {
        "kind": "common",
        "token": "Summer",
        "bits": 7.303780748177103
      },
      {
        "kind": "date",
        "token": "2024",
        "bits": 7.22881869049588
      }
    ],
    "crackTimes": [
      {
        "id": "onlineThrottled",
        "label": "Online, rate-limited",
        "guessesPerSecond": 0.027777777777777776,
        "seconds": 81054000.00000016,
        "display": "3 years"
      },
      {
        "id": "onlineFast",
        "label": "Online, no rate limit",
        "guessesPerSecond": 10,
        "seconds": 225150.0000000002,
        "display": "3 days"
      },
      {
        "id": "offlineSlow",
        "label": "Offline, slow hash",
        "guessesPerSecond": 10000,
        "seconds": 225.1500000000002,
        "display": "4 minutes"
      },
      {
        "id": "offlineFast",
        "label": "Offline, fast hash",
        "guessesPerSecond": 10000000000,
        "seconds": 0.00022515000000000021,
        "display": "less than a second"
      }
    ]
  }
}