--- title: "Strengthcheck" method: POST path: "/v1/b2b/passwords/strength_check" tags: ["Password"] --- # Strengthcheck `POST /v1/b2b/passwords/strength_check` ## Request - Base URL: `https://api.stytch.com` - URL: `https://api.stytch.com/v1/b2b/passwords/strength_check` - Auth: HTTP basic This API allows you to check whether the user’s provided password is valid, and to provide feedback to the user on how to increase the strength of their password. This endpoint adapts to your Project's password strength configuration. If you're using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the default, your passwords are considered valid if the strength score is >= 3. If you're using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), your passwords are considered valid if they meet the requirements that you've set with Stytch. You may update your password strength configuration on the [Passwords Policy page](https://stytch.com/dashboard/password-strength-config) in the Stytch Dashboard. ## Password feedback The `zxcvbn_feedback` and `luds_feedback` objects contains relevant fields for you to relay feedback to users that failed to create a strong enough password. If you're using [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain warning and suggestions for any password that does not meet the [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) strength requirements. You can return these strings directly to the user to help them craft a strong password. If you're using [LUDS](https://stytch.com/docs/guides/passwords/strength-policy), the feedback object will contain a collection of fields that the user failed or passed. You'll want to prompt the user to create a password that meets all requirements that they failed. ## Request body - ApiB2bPasswordV1StrengthCheckRequest: Request type - `password` string, required: The password to authenticate, reset, or set for the first time. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characters, etc. - `email_address` string: The email address of the Member. ## Response `200` Successful response - ApiB2bPasswordV1StrengthCheckResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `valid_password` boolean, required: Returns `true` if the password passes our password validation. We offer two validation options, [zxcvbn](https://stytch.com/docs/guides/passwords/strength-policy) is the default option which offers a high level of sophistication. We also offer [LUDS](https://stytch.com/docs/b2b/guides/passwords/strength-policy) which is less sophisticated but easier to understand. If an email address is included in the call we also require that the password hasn't been compromised using built-in breach detection powered by [HaveIBeenPwned](https://haveibeenpwned.com/) - `score` integer, required: The score of the password determined by [zxcvbn](https://github.com/dropbox/zxcvbn). Values will be between 1 and 4, a 3 or greater is required to pass validation. - `breached_password` boolean, required: Returns `true` if the password has been breached. Powered by [HaveIBeenPwned](https://haveibeenpwned.com/). - `strength_policy` string, required: The strength policy type enforced, either `zxcvbn` or `luds`. - `breach_detection_on_create` boolean, required: Will return `true` if breach detection will be evaluated. By default this option is enabled. This option can be disabled in the [dashboard](https://stytch.com/dashboard/password-strength-config#breach-detection). If this value is false then `breached_password` will always be `false` as well. - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. - `luds_feedback` ApiB2bPasswordV1LudsFeedback - `has_lower_case` boolean, required: For LUDS validation, whether the password contains at least one lowercase letter. - `has_upper_case` boolean, required: For LUDS validation, whether the password contains at least one uppercase letter. - `has_digit` boolean, required: For LUDS validation, whether the password contains at least one digit. - `has_symbol` boolean, required: For LUDS validation, whether the password contains at least one symbol. Any UTF8 character outside of a-z or A-Z may count as a valid symbol. - `missing_complexity` integer, required: For LUDS validation, the number of complexity requirements that are missing from the password. Check the complexity fields to see which requirements are missing. - `missing_characters` integer, required: For LUDS validation, this is the required length of the password that you've set minus the length of the password being checked. The user will need to add this many characters to the password to make it valid. - `zxcvbn_feedback` ApiB2bPasswordV1ZxcvbnFeedback - `warning` string, required: For zxcvbn validation, contains an end user consumable warning if the password is valid but not strong enough. - `suggestions` string[], required: For zxcvbn validation, contains end user consumable suggestions on how to improve the strength of the password. ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2025-09-17** `8270cf3a3d4c`: 3 info - added the media type `application/json` for the response with the status `401` - added the media type `application/json` for the response with the status `500` - added the non-success response with the status `429` - **2025-09-17** `25964b4a5e32`: 1 info - api operation id `api_multitenant_password_v1_StrengthCheck` removed and replaced with `api_b2b_password_v1_StrengthCheck` - **2025-09-17** `864b9f438ac0`: 11 breaking - the `breach_detection_on_create` response's property type changed from `string` to `boolean` for status `200` - the `breached_password` response's property type changed from `string` to `boolean` for status `200` - the `luds_feedback/has_digit` response's property type changed from `string` to `boolean` for status `200` - the `luds_feedback/has_lower_case` response's property type changed from `string` to `boolean` for status `200` - …7 more [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/b2b/passwords/strength_check/post.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)