Password Strength API

GET

Catch weak passwords at signup before accounts are created.

Password Strength checks how strong a password is. It returns a strength label and score, a breakdown of the character types used, weak-pattern detection, theoretical entropy in bits, and recommendations to improve it.

Try it — live request, no key required

Request

GETapi.apiverve.com/v1/passwordstrength?password=Password123

Query parameters

passwordstring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "strength": "weak",
    "score": 1,
    "passwordInfo": {
      "length": 11,
      "hasSpecialCharacters": false,
      "hasNumbers": true,
      "hasLowercase": true,
      "hasUppercase": true,
      "hasSpaces": false,
      "hasSequentialChars": true,
      "hasRepeatedChars": false
    },
    "recommendations": [
      "Use at least 12 characters",
      "Add special characters",
      "Avoid sequential characters (e.g. abc, 123)"
    ],
    "entropyBits": 65.5
  }
}

About the Password Strength API

Password Strength works by analyzing the password provided — its length, character-set composition, and weak patterns like sequential or repeated characters. It returns a strength label, score, theoretical charset entropy and actionable recommendations. The password is never stored or returned.

What people use it for

Registration Form Validation: Flag low strength scores during user registration to block predictable credentials before storing new customer profiles.
Password Reset Verification: When employees reset their workstation credentials, verify the input avoids repeated characters and sequential patterns before approving the change.
Banking Portal Onboarding: Fintech apps evaluate customer passphrases during setup, requiring a strong rating and varied character classes before activating account access.
Credential Policy Enforcement: To enforce corporate security standards, identity services check character class flags and minimum score levels across legacy user databases.

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

Other ways to use Password Strength

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the Password Strength API.

Read the docs →

Is it cheap enough to evaluate passwords on every signup?

Yes. Each validation uses 2 credits, which works out to about $0.30 per 1,000 checks on the Starter plan. Starter includes 100,000 checks per month, while the Free plan provides 100 calls monthly to test your integration.

Are actionable recommendations and entropy bits included on the Free plan?

No. The improvement recommendations and theoretical entropy bit calculations are premium fields. Any paid plan starting with Starter unlocks them, while the Free plan provides the strength label, numeric score, and character flags.

Are submitted passwords stored or logged?

No. Password Strength never stores or returns the password you send. The string is analyzed in memory for character composition, predictable patterns, and entropy, and is never persisted.

What specific weak patterns does the check detect?

It detects runs of three or more sequential characters like 'abc' or '123', along with characters repeated three or more times in a row like 'aaa'. It also checks for spaces, numbers, special characters, and lowercase or uppercase letters.

What strength tiers and scores does the API return?

Each check returns a numeric score from 0 to 3 along with a corresponding strength label. The labels classify passwords directly as too weak, weak, medium, or strong.

Request parameters — GET /v1/passwordstrength

Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`password`Required	string	`Password123`	The password to check the strength of

Example request

1
2

curl "https://api.apiverve.com/v1/passwordstrength?password=Password123" \
  -H "x-api-key: YOUR_API_KEY"

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — GET /v1/passwordstrength

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "strength": "weak",
    "score": 1,
    "passwordInfo": {
      "length": 11,
      "hasSpecialCharacters": false,
      "hasNumbers": true,
      "hasLowercase": true,
      "hasUppercase": true,
      "hasSpaces": false,
      "hasSequentialChars": true,
      "hasRepeatedChars": false
    },
    "recommendations": [
      "Use at least 12 characters",
      "Add special characters",
      "Avoid sequential characters (e.g. abc, 123)"
    ],
    "entropyBits": 65.5
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`strength`	string	`"weak"`	Strength label: too weak, weak, medium or strong
`score`	number	`1`	Numeric strength score (0-3, higher is stronger)
`passwordInfo`	object	`{...}`	Character composition of the password: length and which character classes and patterns it contains
`length`	number	`11`	Number of characters in the password
`hasSpecialCharacters`	boolean	`false`	Whether the password contains special characters
`hasNumbers`	boolean	`true`	Whether the password contains numbers
`hasLowercase`	boolean	`true`	Whether the password contains lowercase letters
`hasUppercase`	boolean	`true`	Whether the password contains uppercase letters
`hasSpaces`	boolean	`false`	Whether the password contains spaces
`hasSequentialChars`	boolean	`true`	Whether the password contains a run of 3+ sequential characters (e.g. abc, 123)
`hasRepeatedChars`	boolean	`false`	Whether the password repeats the same character 3+ times in a row (e.g. aaa)
`recommendations`Premium	array	`[Use at least 12 characters, ...]`	List of recommendations to improve password strength
`entropyBits`Premium	number	`65.5`	Theoretical charset entropy in bits (length times log2 of the character-set size). This is the ceiling assuming random character selection; it does not account for dictionary words or common patterns, so use the strength/score for real-world guidance

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 2 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	Password Strength calls	Per 1,000 calls
Free	Free	200	100	Free
Starter	$29.99	200,000	100,000	$0.30
Pro	$99.99	1,000,000	500,000	$0.20
Mega	$299.99	4,000,000	2,000,000	$0.15

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — GET /v1/passwordstrength

No SDK to install — this is a plain HTTPS call to /v1/passwordstrength with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/passwordstrength" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/passwordstrength-apiSource, issues and the examples this page is built from.ReferencePassword Strength API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/passwordstrengthnpm apiverve-passwordstrengthPyPI APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — GET /v1/passwordstrength

Install the Node.js SDK, then call the Password Strength API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/passwordstrength

Node.js

const res = await fetch("https://api.apiverve.com/v1/passwordstrength", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/passwordstrengthThe published Node.js client, versioned and signed.GitHubapiverve/passwordstrength-apiSource, issues and the examples this page is built from.ReferencePassword Strength API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

apiverve-passwordstrengthPyPI APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — GET /v1/passwordstrength

Install the Python SDK, then call the Password Strength API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — PyPI

pip install apiverve-passwordstrength

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/passwordstrength",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

PyPIapiverve-passwordstrengthThe published Python client, versioned and signed.GitHubapiverve/passwordstrength-apiSource, issues and the examples this page is built from.ReferencePassword Strength API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/passwordstrengthnpm APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — GET /v1/passwordstrength

Install the C# / .NET SDK, then call the Password Strength API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.PasswordStrength

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/passwordstrength");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.PasswordStrengthThe published C# / .NET client, versioned and signed.GitHubapiverve/passwordstrength-apiSource, issues and the examples this page is built from.ReferencePassword Strength API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/passwordstrengthnpm apiverve-passwordstrengthPyPI

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — GET /v1/passwordstrength

No SDK to install — this is a plain HTTPS call to /v1/passwordstrength with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/passwordstrength", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/passwordstrengthnpm apiverve-passwordstrengthPyPI APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — GET /v1/passwordstrength

No SDK to install — this is a plain HTTPS call to /v1/passwordstrength with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/passwordstrength");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/passwordstrengthnpm apiverve-passwordstrengthPyPI APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — GET /v1/passwordstrength

No SDK to install — this is a plain HTTPS call to /v1/passwordstrength with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/passwordstrength")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/passwordstrengthnpm apiverve-passwordstrengthPyPI APIVerve.API.PasswordStrengthNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

All articles →

Add Secure Password Generation to Your AppGenerate cryptographically secure passwords via API. Tutorial with code examples for signup flows, admin panels, and password managers.Read

Preventing Fake Signups: Registration Fraud GuideLearn how to stop bots and fraudsters while maintaining conversion rates for legitimate users.Read

Email Validation Best Practices: Beyond Simple RegexEmail validation beyond regex. Learn how to verify deliverability without rejecting legitimate users.Read

Password Strength API

Try it — live request, no key required

About the Password Strength API

What people use it for

Ways to call it

Other ways to use Password Strength

Questions.

Request parameters — GET /v1/passwordstrength

Required

Authentication

Response — GET /v1/passwordstrength

Response fields

Response headers

Errors

What a call costs — 2 credits per call

Call it from cURL — GET /v1/passwordstrength

Resources

Also published for

Call it from Node.js — GET /v1/passwordstrength

Resources

Also published for

Call it from Python — GET /v1/passwordstrength

Resources

Also published for

Call it from C# / .NET — GET /v1/passwordstrength

Resources

Also published for

Call it from Go — GET /v1/passwordstrength

Resources

Also published for

Call it from PHP — GET /v1/passwordstrength

Resources

Also published for

Call it from Ruby — GET /v1/passwordstrength

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — Password Strength API

Data Validation

Related articles

Ready to build with Password Strength? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog