REST API

Free password generation API. No authentication required. Rate limit: 60 req / min / IP

Endpoint

GET https://pwgen.de/api/generate

Query parameters

Parameter	Type	Default	Description
type	string	classic	Password type: classic \| passphrase \| pattern \| pin \| pronounceable \| token
preset	string	—	Named recipe for a framework secret, for example laravel-app-key. Determines the result on its own; all other parameters are ignored. Template presets such as wordpress-salts return a multi-line block in password.
pattern	string	—	Structure template, required for type=pattern. Max. 256 characters, max. 4096 characters of output.
length	integer	16	Character length (1–512). Used by classic, pin, pronounceable, token.
wordCount	integer	4	Number of words (2–20). Used by passphrase.
separator	string	-	Word separator. Used by passphrase.
wordlist	string	en	Full Diceware wordlist: de \| en. Used by passphrase.
includeUpper	boolean	true	Include uppercase letters (A–Z). classic only.
includeLower	boolean	true	Include lowercase letters (a–z). classic only.
includeDigits	boolean	true	Include digits (0–9). classic only.
includeSymbols	boolean	false	Include symbols (!@#…). classic only.
excludeAmbiguous	boolean	false	Exclude ambiguous characters (0, O, l, I, 1). classic only.
symbolSet	string	!@#…	Custom symbol characters (max. 50). classic only.
tokenFormat	string	base62	Token encoding: base62 \| base58 \| hex \| nanoid. token only.
minEntropy	number	0	Minimum entropy in bits. Returns ENTROPY_TOO_LOW if unmet.

Pattern syntax

A pattern describes the structure of a value. Any character that is not a class or a special character is a literal; write "\d" for a literal "d".

l u d s a	lowercase, uppercase, digits, symbols, alphanumeric
h H	hex lowercase / uppercase
c v	consonants / vowels
w	a word from the Diceware list
[A-Z0-9]	explicit character set
{4} {8,12}	repetition, fixed or a uniform range
( ) ( )~	group, optionally shuffled

A range such as a-z is only allowed within one class (digits, a-z or A-Z). Write "\-" for a literal dash.

Response

All responses are application/json. Passwords are never logged or stored server-side.

{
  "password": "aX3!mQ9kRv2nLp8w",
  "entropy": 104.8,
  "strength": "very-strong",
  "charsetSize": 90,
  "crackTime": "longer than the age of the universe"
}

strength

very-weak · weak · fair · strong · very-strong

entropy

Shannon entropy in bits

crackTime

At 10¹² guesses/sec (offline attack)

Examples

Classic password (default)

curl "https://pwgen.de/api/generate"

Strong classic password

curl "https://pwgen.de/api/generate?type=classic&length=24&includeSymbols=true"

Passphrase (5 words)

curl "https://pwgen.de/api/generate?type=passphrase&wordCount=5&separator=-&wordlist=de"

6-digit PIN

curl "https://pwgen.de/api/generate?type=pin&length=6"

API token (hex, 32 characters)

curl "https://pwgen.de/api/generate?type=token&length=32&tokenFormat=hex"

Laravel APP_KEY via preset

curl "https://pwgen.de/api/generate?preset=laravel-app-key"

WordPress salts for wp-config.php

curl -s "https://pwgen.de/api/generate?preset=wordpress-salts" | jq -r .password

Licence key via pattern

curl "https://pwgen.de/api/generate?type=pattern&pattern=([A-Z0-9]{5}-){3}[A-Z0-9]{5}"

Rate limiting

Each IP is limited to 60 requests per minute. The following headers are returned on every GET response:

X-RateLimit-LimitMaximum requests per window

X-RateLimit-RemainingRequests remaining in the current window

X-RateLimit-ResetUnix timestamp when the window resets

Retry-AfterSeconds to wait after a 429 response

An exceeded limit returns 429 RATE_LIMITED .

Stable error codes

Errors use a language-neutral JSON envelope: { "error": { "code": "…" } }. Do not rely on response text.

INVALID_QUERYA query parameter is invalid or outside its allowed range.

INVALID_OPTIONSThe selected options cannot produce a password.

ENTROPY_TOO_LOWThe requested minimum entropy cannot be met.

INVALID_PATTERNThe pattern is malformed, missing, or exceeds a limit.

UNKNOWN_PRESETThe requested preset does not exist.

RATE_LIMITEDThe per-IP rate limit was exceeded.

METHOD_NOT_ALLOWEDOnly GET and OPTIONS are supported.

INTERNAL_ERRORA required server resource is unavailable.