Name: Password Strength API | Entropy Analysis & Security Check
Brand: viv-data
SKU: api-viv-data-password
Availability: InStock
Author: API Market

gia ly bui

# Password Strength Checker — Entropy Analysis

## Overview
The Password Strength Checker API provides an advanced, entropy-based analysis of passwords, offering a comprehensive assessment of their security. This powerful AI model evaluates passwords on a scale of 0-100, providing an estimated crack time, and actionable suggestions for improvement. Designed with security and privacy at its core, the API processes all passwords in memory, ensuring no data is ever stored, logged, or transmitted, making it a GDPR-friendly solution for robust password validation.

## Features
*   **Entropy-Based Scoring:** Utilizes sophisticated entropy calculations to quantify the randomness (bits of randomness) of a password, providing a highly accurate strength score.
*   **Detailed Strength Metrics:** Assesses password length, character variety (uppercase, lowercase, digits, symbols), and detects common patterns or sequences to provide a nuanced strength rating.
*   **Crack Time Estimation:** Offers realistic estimates of how long it would take to crack a password, ranging from instant to centuries, based on current computational capabilities.
*   **Improvement Suggestions:** Generates clear, actionable recommendations to enhance password strength, guiding users toward more secure choices.
*   **Zero Data Storage:** Passwords are processed entirely in memory and never stored, logged, or transmitted, ensuring maximum user privacy and compliance.
*   **Pure Algorithm:** Operates without external dependencies, making it highly reliable and efficient.
*   **GDPR-Friendly:** Built with privacy by design, this API ensures no sensitive data leaves the server.

## Use Cases
*   **User Registration & Account Creation:** Implement real-time password strength feedback during user sign-up flows, guiding users to create strong, secure passwords from the outset, reducing the risk of account takeovers.
*   **Password Reset Workflows:** Enhance the security of password reset processes by enforcing minimum strength requirements for new passwords, preventing users from setting easily guessable credentials.
*   **Enterprise Security Audits & Compliance:** Integrate into internal security tools to audit existing password policies or assess the strength of employee passwords (with proper consent and anonymization where applicable), ensuring compliance with security standards like NIST or PCI DSS.
*   **Developer Tools & Libraries:** Offer a robust password strength assessment utility within your own applications, libraries, or plugins, providing value to your users and enhancing the security posture of their platforms.
*   **Online Banking & Financial Services:** Deploy in sensitive environments where password security is paramount, such as banking or investment platforms, to protect user assets and maintain trust through strong authentication practices.

## Pricing
This API operates on a usage-based pricing model. One API unit equals one password strength check. Different pricing tiers are available based on usage volume, offering flexibility for various application needs.

*   **Free:** 5,000 requests per month
*   **Pro:** $19.99 for 50,000 requests per month

## API Documentation

### Base URL
All API requests should be made to:
`https://prod.api.market/api/v1/viv-data/password`

### Authentication
Authentication is handled via API key. Include your API key in the request header:

```
x-api-market-key: YOUR_API_MARKET_KEY
```

### Processing Mode
This API utilizes **Synchronous Processing**. This means that a single request to an endpoint will return the final result directly in its response. There are no job IDs, no polling, and no separate status checks required. For longer-running requests, it is recommended to set a client-side request timeout of at least 30-60 seconds to accommodate processing time, though typical password checks are near-instant.

### Endpoints

#### Check Password Strength
Analyzes a given password for its strength, providing a score, crack time estimate, and improvement suggestions.

*   **Endpoint:** `GET /api/v1/viv-data/password/check`
*   **Summary:** Check password strength.

**Request Parameters:**

| Name       | Location | Type   | Required | Description         |
| :--------- | :------- | :----- | :------- | :------------------ |
| `password` | Query    | string | Yes      | Password to analyze |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/viv-data/password/check?password=MyP%40ssw0rd!" \
  -H "x-api-market-key: YOUR_API_MARKET_KEY"
```

**Example Response:**

```json
{
  "password": "MyP@ssw0rd!",
  "score": 78,
  "strength": "Strong",
  "length": 12,
  "has_upper": true,
  "has_lower": true,
  "has_digit": true,
  "has_special": true,
  "suggestions": [],
  "crack_time": "3 years",
  "entropy_bits": 52
}
```

**Response Schema (`PasswordResult`):**

| Field         | Type            | Description                                              | Required |
| :------------ | :-------------- | :------------------------------------------------------- | :------- |
| `score`       | integer         | Numerical strength score (0-100).                        | Yes      |
| `strength`    | string          | Categorical strength rating (e.g., "Weak", "Strong").    | Yes      |
| `length`      | integer         | The length of the analyzed password.                     | Yes      |
| `has_upper`   | boolean         | True if the password contains uppercase letters.         | Yes      |
| `has_lower`   | boolean         | True if the password contains lowercase letters.         | Yes      |
| `has_digit`   | boolean         | True if the password contains digits.                    | Yes      |
| `has_special` | boolean         | True if the password contains special characters.        | Yes      |
| `suggestions` | array of string | A list of suggestions to improve password strength.      | No       |
| `crack_time`  | string or null  | Estimated time to crack the password (e.g., "3 years"). | No       |

#### Health Check
Checks the health of the API service.

*   **Endpoint:** `GET /api/v1/viv-data/password/health`
*   **Summary:** Health Check
*   **Response:** `200 OK` (empty JSON object on success)

```bash
curl -X GET "https://prod.api.market/api/v1/viv-data/password/health" \
  -H "x-api-market-key: YOUR_API_MARKET_KEY"
```

## Status Codes
| Code | Meaning                   | Description                                                                                             |
| :--- | :------------------------ | :------------------------------------------------------------------------------------------------------ |
| 200  | OK                        | Request successful. The response body contains the requested data.                                      |
| 201  | Created                   | Resource successfully created (not applicable for this API's current endpoints).                        |
| 400  | Bad Request               | Invalid input parameters or malformed request. Check your request body or query parameters.             |
| 401  | Unauthorized              | Missing or invalid API key. Ensure `x-api-market-key` header is present and valid.                      |
| 403  | Forbidden                 | Valid API key but insufficient permissions for the requested action, or rate limit exceeded.            |
| 404  | Not Found                 | The requested resource or endpoint was not found. Check the URL path.                                   |
| 422  | Unprocessable Entity      | Validation error, typically for invalid input values that could not be processed. Details in response.  |
| 429  | Too Many Requests         | Rate limit exceeded. Slow down your requests and implement a retry mechanism.                           |
| 500  | Internal Server Error     | A server-side error occurred. This indicates an issue on the API provider's end.                       |
| 503  | Service Unavailable       | The service is temporarily unable to handle the request, often due to maintenance or overload.          |

## Rate Limits
The API enforces rate limits to ensure fair usage and service stability. Exceeding these limits will result in a `429 Too Many Requests` HTTP status code. To prevent hitting rate limits, distribute your requests over time and implement exponential backoff for retries. Refer to the pricing section for available request volumes.

## Error Handling
Effective error handling is crucial for building robust applications. When an error occurs, the API will return an appropriate HTTP status code (e.g., 400, 401, 404, 422, 429, 500, 503) along with a JSON response detailing the error.

**Interpreting Error Responses:**
Error responses typically follow a standard structure, helping you understand the cause of the failure.

**Common Errors & Resolutions:**
*   **`400 Bad Request` / `422 Unprocessable Entity`:** Indicates issues with your input, such as a missing `password` query parameter or an improperly formatted request. Check the error message in the JSON response for specifics.
*   **`401 Unauthorized`:** Your API key is either missing or invalid. Ensure you include `x-api-market-key` in your request headers with a correct key.
*   **`404 Not Found`:** The endpoint you are trying to reach does not exist. Double-check the API path.
*   **`429 Too Many Requests`:** You have exceeded your allocated rate limit. Implement exponential backoff for retries or consider upgrading your plan.
*   **`5xx Internal Server Error` / `503 Service Unavailable`:** These are server-side issues. While rare, they indicate a problem with the API itself. You should implement retry logic for these transient errors.

**Retry Strategies:**
For transient errors (`429`, `500`, `503`), implement an exponential backoff strategy:
1.  Wait for an initial short duration (e.g., 1 second).
2.  If the request fails again, double the wait time.
3.  Continue doubling the wait time for a predefined number of retries, or until a maximum wait time is reached (e.g., 60 seconds).
4.  If the request still fails after all retries, treat it as a persistent error.

**Error Response Example:**

```json
{
  "error": {
    "code": "invalid_parameter",
    "message": "The query parameter 'password' is required",
    "status": 422
  }
}
```

## Implementation Guide

### Example Code
These examples demonstrate how to make synchronous requests to the Word Strength Checker API in various programming languages.

#### JavaScript

```javascript
const apiKey = "YOUR_API_MARKET_KEY";
const baseUrl = "https://prod.api.market/api/v1/viv-data/password";

async function checkPasswordStrength(password) {
  try {
    const encodedPassword = encodeURIComponent(password);
    const response = await fetch(`${baseUrl}/check?password=${encodedPassword}`, {
      method: "GET",
      headers: {
        "x-api-market-key": apiKey
      }
    });

    if (!response.ok) {
      const errorData = await response.json();
      throw new Error(`API error ${response.status}: ${errorData.error?.message || response.statusText}`);
    }

    const result = await response.json();
    console.log("Password strength result:", result);
    return result;
  } catch (error) {
    console.error("Error checking password strength:", error);
    throw error;
  }
}

// Example usage:
checkPasswordStrength("MyP@ssw0rd!123").catch(console.error);
```

#### Python

```python
import requests

API_KEY = "YOUR_API_MARKET_KEY"
BASE_URL = "https://prod.api.market/api/v1/viv-data/password"

def check_password_strength(password):
    headers = {
        "x-api-market-key": API_KEY
    }
    params = {
        "password": password
    }

    try:
        response = requests.get(f"{BASE_URL}/check", headers=headers, params=params)
        response.raise_for_status()  # Raises HTTPError for bad responses (4xx or 5xx)

        result = response.json()
        print("Password strength result:", result)
        return result
    except requests.exceptions.HTTPError as http_err:
        print(f"HTTP error occurred: {http_err} - {response.text}")
        raise
    except Exception as err:
        print(f"An error occurred: {err}")
        raise

# Example usage:
check_password_strength("MyP@ssw0rd!123")
```

#### cURL

```bash
# Example for checking password strength
curl -X GET "https://prod.api.market/api/v1/viv-data/password/check?password=MyP%40ssw0rd!123" \
  -H "x-api-market-key: YOUR_API_MARKET_KEY"
```

### Performance Optimization
*   **Batching (if applicable):** While this API processes single passwords, if you have many passwords to check, process them sequentially with small delays rather than sending them all at once to avoid hitting rate limits.
*   **Client-Side Validation:** For basic password requirements (e.g., minimum length), implement client-side validation to provide instant feedback and reduce unnecessary API calls.
*   **Caching:** For a given password, its strength result will not change. If your application frequently checks the same passwords (e.g., from a list of common passwords), consider caching the results.
*   **Error Handling and Retries:** Implement robust error handling with exponential backoff for transient errors (e.g., `429 Too Many Requests`, `500 Internal Server Error`, `503 Service Unavailable`) to ensure your application gracefully recovers from temporary issues.

## FAQ

**Q: Is the API GDPR compliant?**
A: Yes. The API is designed with privacy in mind. Passwords are processed entirely in memory and are never stored, logged, or transmitted, ensuring full GDPR compliance.

**Q: What is entropy analysis?**
A: Entropy analysis in this context measures the amount of randomness or unpredictability in a password. Higher entropy (measured in bits) indicates a more random and thus stronger password, making it harder to guess or crack.

**Q: Can I use this API for internal security audits?**
A: Yes, provided you adhere to all applicable privacy laws and internal policies regarding user data. Given the API's zero-storage policy, it's suitable for such uses as it doesn't retain sensitive information.

**Q: What happens if I exceed my rate limit?**
A: If you exceed your allocated requests per month or hit a temporary rate limit, the API will return a `429 Too Many Requests` HTTP status code. You should implement a retry mechanism with exponential backoff.

**Q: Does the API suggest improvements for weak passwords?**
A: Yes, the API response includes a `suggestions` array, which provides actionable recommendations to help users create stronger passwords.

**Q: How accurate are the crack time estimates?**
A: The crack time estimates are based on current computational capabilities and common cracking techniques. While they provide a realistic assessment, actual crack times can vary based on the attacker's resources and methods. They are intended as a guide to relative strength.

## Contact Us
If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.

Use this API to instantly check password strength via advanced entropy analysis. Get accurate scores, crack time estimates, and improvement suggestions securely