# SuggestPassword

> Free, private tools for strong passwords: a password generator, passphrase generator, PIN generator, password strength checker and WiFi password + QR code generator, plus a free JSON API. Everything on the website is generated in the visitor's browser with crypto.getRandomValues(); nothing is sent to the server.

Key facts:
- Passwords: 4–128 characters, upper/lowercase, digits, basic symbols (!#&) or all symbols (!#&-=~@$%^*_+.?|), optional removal of look-alike characters (0 O o 1 l I |). Every enabled character type is guaranteed to appear, while keeping all valid passwords equally likely.
- Passphrases: 3–12 random words from the EFF large diceware list (7,776 words, ~12.9 bits per word), with separator, capitalisation and an optional digit.
- PINs: 4–12 random digits.
- Strength checker: zxcvbn-based estimate of guesses and cracking time, plus an optional Have I Been Pwned k-anonymity breach check (only the first 5 characters of the SHA-1 hash are sent).
- Available in English, Dutch, German, French, Spanish and Portuguese.
- No account, no API key, no ads.

## Tools

- [Password generator](https://suggestpassword.com/): random passwords with a live entropy/strength meter
- [Passphrase generator](https://suggestpassword.com/passphrase-generator): memorable diceware passphrases
- [PIN generator](https://suggestpassword.com/pin-generator): random PIN codes
- [Password strength checker](https://suggestpassword.com/password-strength-checker): cracking time, weaknesses and breach check
- [WiFi password generator](https://suggestpassword.com/wifi-password-generator): WiFi password plus a QR code guests can scan

## API

- [API documentation](https://suggestpassword.com/developers): parameters, examples (curl, JavaScript, Python), errors and limits
- [OpenAPI 3.1 specification](https://api.suggestpassword.com/openapi.json): machine-readable description, usable as an agent tool definition
- Endpoint: `GET https://api.suggestpassword.com/` returns JSON like `{"generated_password": "...", "passwords": ["..."], "type": "password", "entropy_bits": 119.7}`
- Examples: `?length=32&symbols=all&count=10`, `?type=passphrase&words=6&separator=space`, `?type=pin&length=6`
- Free, CORS enabled for all origins, rate-limited per IP (HTTP 429 when exceeded), invalid input returns HTTP 400 with `{"error": "..."}`.

## Guides

- [Password vs passphrase](https://suggestpassword.com/guides/password-vs-passphrase): when to use each and how long they should be
- [How password cracking works](https://suggestpassword.com/guides/how-password-cracking-works): online vs offline attacks, dictionaries, rules, brute force, credential stuffing
- [How to choose a secure PIN](https://suggestpassword.com/guides/how-to-choose-a-pin): PINs to avoid and recommended lengths

## Optional

- [Privacy policy](https://suggestpassword.com/privacy)
- [Contact](https://suggestpassword.com/contact)