Anvil › Docs › /v1/password

Random password generator API with entropy estimate

Ask for one or more random passwords and get them back with an honest strength figure: the number of bits of entropy, which is how many times you'd have to double a guessing effort to try every possibility.

Parameters

Example

Request:

GET https://api.oddlathe.com/v1/password?length=24&count=2

Response (generated by the real code when these docs were last built; random or time-based values will differ for you):

{
 "passwords": [
  "WbC0Bq8=fLxA8g,y6+2sNM0(",
  "C+3@KU4bLK3&2d4BK8&n7[9F"
 ],
 "entropy_bits": 154.6,
 "strength": "excellent"
}

Code examples

curl 'https://api.oddlathe.com/v1/password?length=24&count=2'

const params = new URLSearchParams({
  length: "24",
  count: "2"
});
const res = await fetch(`https://api.oddlathe.com/v1/password?${params}`);
if (!res.ok) throw new Error((await res.json()).error.message);
const data = await res.json();
console.log(data);

import json, urllib.parse, urllib.request

params = urllib.parse.urlencode({"length": "24", "count": "2"})
url = "https://api.oddlathe.com/v1/password?" + params
# Send a User-Agent: the edge network refuses Python's default one.
req = urllib.request.Request(url, headers={"User-Agent": "my-script/1.0"})
with urllib.request.urlopen(req, timeout=10) as r:
    data = json.load(r)
print(data)

When it's useful

• Initial passwords for test accounts or staging environments
• Generating secrets inside low-code automations that can't run their own code
• Showing users what a strong password looks like

Good to know

• Entropy is length × log2(alphabet size). With every set switched on the alphabet has 87 characters, so each one adds about 6.4 bits. Every chosen set is guaranteed to appear at least once.
• Your password travels back over the network. It's HTTPS, never logged, and marked no-store, but for a real account a password manager or a local generator (like the Tooltern one, which runs entirely in your browser) is still the safest choice.
• no_ambiguous removes I, l, 1, O, 0 and o, which helps when someone has to type a password off a screen or paper.

Generated with the operating system's cryptographic random source. Every chosen character set is guaranteed to appear. Nothing is stored; responses are marked no-store. For anything important, generating locally is still best.

Errors

Errors are JSON like {"error": {"code": "…", "message": "…"}}. The ones this endpoint can return:

• bad_param (400): a value is the wrong type or out of range (the message says which)
• rate_limited (429): over 60 requests a minute; wait for Retry-After seconds

Questions

Related endpoints

• /v1/randomRandom integers, coin flips or dice rolls
• /v1/nanoidShort URL-safe random IDs (21 chars, 126 bits)

Prefer a page to an API?

• Password generator that runs in your browser on Tooltern: same job, nothing leaves your browser.

Published 3 November 2026 · OpenAPI 3.1 spec · Limits and privacy