Home › Catalog › Password Tool › Why Forge Password
The big password-manager brands all host a free in-browser password generator on their marketing site. They are fine if you want one strong password right now in a tab. The Forge Password API is what you reach for when you need to script it, batch a hundred for a provisioning run, score entropy of an existing password, or generate xkcd-style passphrases without installing a password manager.
| Feature | Forge Password | 1Password / Bitwarden / LastPass generators |
|---|---|---|
| Generate a password in the browser | ✓ | ✓ |
| Free REST API for scripts & CI | ✓ (GET /password) | × (browser only on the public site) |
| Batch generation (up to 100 per call) | ✓ (POST /password/multiple) | × |
| Standalone entropy & crack-time scoring | ✓ (POST /password/strength) | × (bundled into the manager UI) |
| xkcd-style passphrase generator | ✓ (719-word curated wordlist) | partial (Bitwarden offers it; 1Password gates it in-app) |
| Common-pattern detection (sequences, repeats) | ✓ | × |
| Cost | $0, no signup, no API key | $0 for the browser tool; full product is paid |
| Requires installing a password manager | × | only for the manager features, not the generator page |
The 1Password, Bitwarden, and LastPass password generators on their marketing sites exist to demonstrate the manager you might subscribe to. They are excellent generators, but they are not addressable from a script. Forge Password is one curl away:
curl "https://forge-node.tail2b516d.ts.net/password?length=24&symbols=true"
The same call works from Python, Node, Go, Bash, or any cron job. No login. No API key. No newsletter.
If you need to seed a hundred dev accounts, rotate service-account passwords, or generate a per-tenant initial-password column in a CSV, you do not want to click a button a hundred times. Forge Password ships a batch endpoint:
curl -X POST "https://forge-node.tail2b516d.ts.net/password/multiple" \
-H "Content-Type: application/json" \
-d '{"count": 100, "length": 20, "symbols": true}'
Returns a JSON array of 100 cryptographically random passwords in a single request. The browser-bundled generators have no equivalent.
Want to audit an existing password column for weak entries? Score them programmatically without showing the raw passwords in a UI:
curl -X POST "https://forge-node.tail2b516d.ts.net/password/strength" \
-H "Content-Type: application/json" \
-d '{"password": "Spring2024!"}'
Returns entropy in bits, crack-time estimate, and common-pattern flags (year suffix, dictionary word with capital, etc.). The password managers bundle this into their UI but do not expose it as a free programmatic check.
The Forge passphrase endpoint generates xkcd-style 4-to-6-word memorable passphrases from a 719-word curated wordlist, with optional separators and capitalization:
curl "https://forge-node.tail2b516d.ts.net/password/passphrase?words=4&separator=-"
Bitwarden has a comparable passphrase generator on its marketing page; 1Password gates the equivalent inside the installed app. The Forge endpoint is open, scriptable, and does not require committing to a manager ecosystem.
Yes. No signup, no API key. Rate-limited per IP to keep abuse low. Details in the Password API docs.
Yes. The endpoint uses the operating system's CSPRNG (os.urandom under the hood). The same source the password managers use.
Entropy in bits (Shannon-style on the character pool), crack-time estimate at a configurable guesses-per-second rate, and pattern flags for sequential characters, repeated characters, year suffixes, and common dictionary words with simple capitalization.
Try the Password tool, or browse the full free API catalog for 15 more developer APIs in the same no-signup style.