🔐 Password Generator API Documentation

📖 Overview

The Password Generator API creates cryptographically secure passwords with customizable complexity options. Built with security best practices, it provides reliable password generation for applications requiring strong authentication.

🔒 Cryptographically Secure

Uses PHP's secure random_int() function for true randomness

⚙️ Customizable Character Sets

Control uppercase, lowercase, numbers, and special characters

📊 Password Strength Analysis

Automatic strength scoring and detailed feedback

📏 Flexible Length

Generate passwords from 1 to 128 characters long

🛡️ Cryptographically Secure 🎯 Zero Logging ⚡ High Performance

🌐 Base URL

https://api.lorwongam.com/api/password-generator/

🔐 Authentication

No authentication required. This is a public API that can be accessed without any API keys or tokens.

📡 API Endpoints

GET / POST / Generate Passwords

Generate one or more passwords using the supplied options. Parameters may be supplied via the query string (GET) or as a JSON body (POST). When action=analyze is supplied, the same endpoint analyses a single password instead.

Request Parameters

Parameter	Type	Required	Default	Description
`min_length`	integer	Optional	8	Minimum length (1–128)
`max_length`	integer	Optional	16	Maximum length (1–128). Must be >= `min_length`
`count`	integer	Optional	5	Number of passwords to generate (1–100)
`include_lowercase`	boolean	Optional	true	Include lowercase letters (a-z)
`include_uppercase`	boolean	Optional	true	Include uppercase letters (A-Z)
`include_numbers`	boolean	Optional	true	Include numbers (0-9)
`include_symbols`	boolean	Optional	false	Include special characters (default set: `!@#$%^&*()_+-=[]{}\|;:,.<>?`)
`exclude_ambiguous`	boolean	Optional	false	Exclude ambiguous characters (`0`, `O`, `1`, `l`, `I`, `\|`, `) from the pool
`no_repeated_chars`	boolean	Optional	false	Prevent repeated characters in a single password
`must_include_each_type`	boolean	Optional	true	Ensure at least one character from each enabled type appears
`custom_symbols`	string	Optional	""	Override the default symbol pool when `include_symbols` is on
`action`	string	Optional	—	Set to `analyze` to score a single password instead of generating
`password`	string	Required (analyze only)	—	Password to analyse when `action=analyze`

Example Request — Basic Passwords (GET)

curl "https://api.lorwongam.com/api/password-generator/?min_length=12&max_length=16&count=1&include_symbols=true"

Example Request — High Security (POST JSON)

curl -X POST "https://api.lorwongam.com/api/password-generator/" \
  -H "Content-Type: application/json" \
  -d '{
    "min_length": 24,
    "max_length": 24,
    "count": 1,
    "include_symbols": true,
    "exclude_ambiguous": true,
    "must_include_each_type": true
  }'

Example Request — Analyse a password

curl "https://api.lorwongam.com/api/password-generator/?action=analyze&password=Kx7mN9pQw2Yv8zR3"

📊 Response Format

Generate Response

{
  "success": true,
  "data": {
    "passwords": [
      {
        "password": "chocuqpj5LBD",
        "length": 12,
        "strength": "strong",
        "score": 5
      }
    ],
    "count": 1,
    "options_used": {
      "min_length": 10,
      "max_length": 12,
      "count": 1,
      "include_lowercase": true,
      "include_uppercase": true,
      "include_numbers": true,
      "include_symbols": false,
      "exclude_ambiguous": false,
      "no_repeated_chars": false,
      "must_include_each_type": true,
      "custom_symbols": ""
    }
  },
  "generation_info": {
    "length_range":     "10-12 characters",
    "character_types": {
      "lowercase": "included",
      "uppercase": "included",
      "numbers":   "included",
      "symbols":   "excluded"
    },
    "security_options": {
      "exclude_ambiguous":      "disabled",
      "no_repeated_chars":      "disabled",
      "must_include_each_type": "enabled"
    }
  },
  "timestamp": "2025-09-09 12:00:00"
}

Analyze Response

{
  "success": true,
  "analysis": {
    "length":        16,
    "has_lowercase": true,
    "has_uppercase": true,
    "has_numbers":   true,
    "has_symbols":   false,
    "strength":      "strong",
    "score":         5
  },
  "tips": [
    "Include special characters (!@#$%^&*)"
  ],
  "timestamp": "2025-09-09 12:00:00"
}

Error Responses

Errors come back as JSON with HTTP 400 and a free-form error string. Validation failures additionally expose a messages array.

Option validation failed

{
  "success": false,
  "error":    "Validation failed",
  "messages": [
    "Minimum length cannot be greater than maximum length",
    "Count must be between 1 and 100"
  ]
}

Missing password for analyze

{
  "success": false,
  "error": "Password is required for analysis"
}

All character types disabled (caught by validation before generation)

{
  "success": false,
  "error":    "Validation failed",
  "messages": [
    "At least one character type must be selected"
  ]
}

💪 Strength Scoring

Every generated password is re-scored through the same analyzePassword() algorithm used by the analyse action. The score is the sum of these rules:

Rule	Points
length >= 8	+1
length >= 12	+1
contains lowercase	+1
contains uppercase	+1
contains numbers	+1
contains symbols	+2

The numeric score (0–7) is then mapped to a lowercase strength label:

Score	Strength label
0–2	`weak`
3–4	`medium`
5–6	`strong`
7	`very strong`

⚠️ Error Conditions

The API returns human-readable error strings rather than numeric codes. Common triggers:

Trigger	HTTP	`error` text
`min_length` < 1	400	Minimum length must be at least 1 character
`max_length` > 128	400	Maximum length cannot exceed 128 characters
`min_length` > `max_length`	400	Minimum length cannot be greater than maximum length
`count` outside 1–100	400	Count must be between 1 and 100
All four character types disabled	400	At least one character type must be selected
`action=analyze` without `password`	400	Password is required for analysis
No password produced (e.g. impossible combo)	400	No passwords could be generated

🛡️ Security Features

Secure randomness: Length and characters are picked with random_int()
No logging: Generated passwords are not persisted anywhere on the server
Character variety: By default must_include_each_type guarantees a mix of types
Ambiguous-character exclusion: Optional filter for visually similar glyphs

🚦 Rate Limits

This endpoint is rate-limited per client identity (IP address, or API key when one is supplied): 60 requests per minute. When the budget is exhausted the API responds with HTTP 429 and includes X-RateLimit-* headers so clients can self-throttle. The exact policy is configured in api/includes/api_config.php.

🔐 Password Generator API