length int Password length in characters (4–128).
default: 16
allowed: 4 – 128
example: length=24
Random Password Generator API
MOCK DATARandom password generator with length, uppercase/digit/symbol toggles, look-alike exclusion, and an honest entropy estimate with a strength rating.
Generated test data for fixtures and development
- Base URL
- /api/passwords
- Category
- Internet & Devices
- Capabilities
- 1 route Seedable
- Last updated
- July 29, 2026
GET /api/passwords
Route reference
Code samples Ready-to-copy requests in 4 languages
Parameters Route-specific request inputs 5
| Parameter | Type | Default & allowed | Description |
|---|---|---|---|
length | int | default: 16 allowed: 4 – 128 example: 24 | Password length in characters (4–128). |
uppercase | boolean | default: true example: true | Include uppercase letters A–Z. Lowercase a–z is always included. |
digits | boolean | default: true example: true | Include digits 0–9. |
symbols | boolean | default: true example: false | Include symbols from the pool !@#$%^&*()-_=+[]{};:,.?/ (24 characters). |
excludeSimilar | boolean | default: false example: true | Remove the easily-confused characters 0, O, 1, l, I and | from every pool — for passwords humans read or type. |
uppercase boolean Include uppercase letters A–Z. Lowercase a–z is always included.
default: true
example: uppercase=true
digits boolean Include digits 0–9.
default: true
example: digits=true
symbols boolean Include symbols from the pool !@#$%^&*()-_=+[]{};:,.?/ (24 characters).
default: true
example: symbols=false
excludeSimilar boolean Remove the easily-confused characters 0, O, 1, l, I and | from every pool — for passwords humans read or type.
default: false
example: excludeSimilar=true
Universal parameters Shared response and formatting options 7
| Parameter | Type | Default & allowed | Description |
|---|---|---|---|
count | int | default: 10 allowed: 1 – 100 example: 3 | How many records to generate (1–100). |
seed | int | example: 42 | Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed). |
fields | list | example: password,length | Return only these fields (comma-separated). Mutually exclusive with 'exclude'. |
exclude | list | example: strength | Return all fields except these (comma-separated). |
format | enum | default: json allowed: json | ndjson | csv example: csv | Response format: json envelope, ndjson (one record per line) or csv. |
pretty | boolean | default: false example: true | Pretty-print the JSON response. |
unwrap | boolean | default: false example: true | Drop the envelope: return the raw array/object without data/meta wrapper. |
count int How many records to generate (1–100).
default: 10
allowed: 1 – 100
example: count=3
seed int Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
example: seed=42
fields list Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
example: fields=password,length
exclude list Return all fields except these (comma-separated).
example: exclude=strength
format enum Response format: json envelope, ndjson (one record per line) or csv.
default: json
allowed: json | ndjson | csv
example: format=csv
pretty boolean Pretty-print the JSON response.
default: false
example: pretty=true
unwrap boolean Drop the envelope: return the raw array/object without data/meta wrapper.
default: false
example: unwrap=true
Response schema Fields returned in each record 4
| Field | Type | Description | Example |
|---|---|---|---|
password | string | The generated password. Contains at least one character of every enabled class. | g7#Vqx!2Lm@9pZ.t |
length | integer | Length of the password in characters (echoes the length parameter). | 16 |
entropyBits | integer | round(length × log2(poolSize)) — theoretical bits of entropy for the selected pools (e.g. 103 for 16 chars over all four classes). | 103 |
strength | string | weak (< 40 bits) | fair (< 60) | strong (< 80) | very-strong (≥ 80). | very-strong |
password string The generated password. Contains at least one character of every enabled class.
example: g7#Vqx!2Lm@9pZ.t
length integer Length of the password in characters (echoes the length parameter).
example: 16
entropyBits integer round(length × log2(poolSize)) — theoretical bits of entropy for the selected pools (e.g. 103 for 16 chars over all four classes).
example: 103
strength string weak (< 40 bits) | fair (< 60) | strong (< 80) | very-strong (≥ 80).
example: very-strong
Documented examples
Build-generated requests and complete responses 3 Three reproducible 16-character passwords /api/passwords?count=3&seed=42
{
"data": [
{
"password": "RHU&Tm53J%g*8:Fd",
"length": 16,
"entropyBits": 103,
"strength": "very-strong"
},
{
"password": "@835T4Aybo*]/=&H",
"length": 16,
"entropyBits": 103,
"strength": "very-strong"
},
{
"password": "r_W&3^DYacwDa4Rm",
"length": 16,
"entropyBits": 103,
"strength": "very-strong"
}
],
"meta": {
"endpoint": "passwords",
"count": 3,
"seed": 42,
"params": {
"length": 16,
"uppercase": true,
"digits": true,
"symbols": true,
"excludeSimilar": false
},
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} 24 characters, letters and digits only /api/passwords?length=24&symbols=false&count=5
{
"data": [
{
"password": "NHGcyP1X6tIwRRt2We5XYmzu",
"length": 24,
"entropyBits": 143,
"strength": "very-strong"
},
{
"password": "R39JAP4pG1brXYXyf6G7NTku",
"length": 24,
"entropyBits": 143,
"strength": "very-strong"
},
{
"password": "3CXIWvb68FmPJawWRaJcjDK4",
"length": 24,
"entropyBits": 143,
"strength": "very-strong"
},
{
"password": "jCPkz5LO7bste690Q74CeSi0",
"length": 24,
"entropyBits": 143,
"strength": "very-strong"
},
{
"password": "ept61irv6TO50Iw0eHc34ZRS",
"length": 24,
"entropyBits": 143,
"strength": "very-strong"
}
],
"meta": {
"endpoint": "passwords",
"count": 5,
"seed": 42,
"params": {
"length": 24,
"uppercase": true,
…
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} Human-friendly: no look-alike characters /api/passwords?length=12&excludeSimilar=true&count=5
{
"data": [
{
"password": "mG*Sd:f69&TH",
"length": 12,
"entropyBits": 76,
"strength": "strong"
},
{
"password": "a/54(Ap]=yT#",
"length": 12,
"entropyBits": 76,
"strength": "strong"
},
{
"password": "4awC_*YWCamc",
"length": 12,
"entropyBits": 76,
"strength": "strong"
},
{
"password": ",2Af8d%_m;Q}",
"length": 12,
"entropyBits": 76,
"strength": "strong"
},
{
"password": "T}])dx&59Uv=",
"length": 12,
"entropyBits": 76,
"strength": "strong"
}
],
"meta": {
"endpoint": "passwords",
"count": 5,
"seed": 42,
"params": {
"length": 12,
"uppercase": true,
…
"generatedAt": "2026-07-29T08:13:22.000Z"
}
} About this API
Coverage & behavior
Generates random passwords from explicit character pools. Lowercase letters (a–z) are always included; uppercase (A–Z), digits (0–9) and symbols (!@#$%^&*()-_=+[]{};:,.?/) each toggle their pool, and excludeSimilar=true removes the look-alike characters 0 O 1 l I | from every pool — useful for passwords people have to read aloud or retype.
Every enabled character class is guaranteed to appear at least once in each password (whenever length ≥ the number of enabled classes, which always holds since length ≥ 4): one character of each class is placed first, then the rest is filled from the combined pool and shuffled. So a 4-character password with all classes on really contains one lowercase, one uppercase, one digit and one symbol.
Each record reports entropyBits = round(length × log2(poolSize)) — the theoretical entropy of a uniformly random password over the selected pool (the one-of-each-class guarantee reduces this marginally) — and a strength band: weak (< 40 bits), fair (< 60), strong (< 80), very-strong (≥ 80).
Passwords come from the platform's seeded, deterministic PRNG — ideal for reproducible fixtures and demos, but do not use them as real credentials; generate those locally with a CSPRNG.
Use it for
- Seed test databases and fixtures with credential strings of a known shape
- Test a password-strength meter against passwords with known entropy
- Fill UI mockups and screenshots with plausible generated passwords
Frequently asked questions
Can I match my app's password policy?
Yes — toggle uppercase, digits and symbols, set length, and excludeSimilar drops lookalike characters (0/O, 1/l) for human-readable test credentials.
Is it safe to generate production passwords here?
No — anything generated over a public HTTP API shouldn't guard real accounts. This is for test fixtures, and the mock badge says so.
What does strength mean?
A label derived from entropyBits, so you can test assertions like "signup rejects weak passwords" against known-strength inputs.
Standards & references
Related APIs
Passphrase Generator API MOCK DATA
Diceware-style random passphrases from a curated 895-word English list — pick word count, separator and capitalization, with an honest entropy estimate.
Fake API Key & Token Generator MOCK DATA
Clearly fake API keys, JWTs and hex/base64 secrets — structurally valid enough to exercise parsers and middleware, cryptographically meaningless by design.
Random Username Generator API MOCK DATA
Random usernames in four distinct styles — handle, gamer, professional, anonymous — with a maxLength that is honored by construction, never by truncation.
Fake Email Address API MOCK DATA
Fake email addresses with name-derived usernames on guaranteed non-deliverable domains (example.com/net/org and .test) — or stamp your own with ?domain=.