---
title: "Measure password strength"
method: POST
path: "/password-strength"
tags: ["Validation"]
---

# Measure password strength

`POST /password-strength`

## Request

- Base URL: `https://api.cofferdock.com`
- URL: `https://api.cofferdock.com/password-strength`
- Auth: API key in header `x-api-key`

Scores a password 0-4 based on length, character variety and estimated entropy, and flags it if it is in a short list of very common passwords. Structural only, not a breached-password database check. The password is never stored or logged.

Costs 1 credit per call.

## Request body

- object
  - `password` string, required: The password to analyze (1 to 256 characters). It is never stored or logged.

## Response `200`

Result.

- object
  - `success` boolean
  - `score` integer
  - `strength` string
  - `length` integer
  - `has_lowercase` boolean
  - `has_uppercase` boolean
  - `has_digit` boolean
  - `has_symbol` boolean
  - `entropy_bits` number
  - `common_password` boolean
  - `meta` object
    - `used` integer: Credits used this month, after this call.
    - `remaining` integer, nullable: Credits left this month (null = unlimited).
    - `unlimited` boolean

## Other responses

- `400`: Invalid input (nothing is charged).
- `401`: Missing or invalid API key.
- `403`: Email not verified.
- `429`: Monthly credit limit reached, or too many requests per minute for this key (see Retry-After).
- `503`: Server busy (queue full). Retry after the seconds in the Retry-After header.

---

[API](https://skmtc.dev/cofferdock/apis/cofferdock-api.md) · [All operations](https://skmtc.dev/cofferdock/apis/cofferdock-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cofferdock/apis/cofferdock-api/revisions/b57aa000d33a?raw)