API Documentation

Integrate Passly into your applications with our REST API

Base URL

Every request starts from this URL. No key, no sign-up.

120

Requests / 10 min

No key

Public API

API version

…

Response time

Productionhttps://passly.fr/api/v1

Endpoints

Three entry points. Expand one to see its parameters, an example and its response.

Generates one or more secure passwords matching the given criteria.

Parameters

lengthinteger

4-128, default: 16Optional

countinteger

1-50, default: 1Optional

formatstring

random, pronounceable, passphraseOptional

lowercaseboolean

Include lowercase letters (default: true)Optional

uppercaseboolean

Include uppercase letters (default: true)Optional

digitsboolean

Include digits (default: true)Optional

specialboolean

Include special characters (default: false)Optional

exclude_similarboolean

Exclude ambiguous characters (default: false)Optional

exclude_customstring

Extra characters to exclude (≤ 256)Optional

capitalizeboolean

Pronounceable: capitalise each syllable (default: true)Optional

include_numbersboolean

Pronounceable: append digits (default: true)Optional

wordsinteger

Passphrases: 3-10Optional

separatorstring

Passphrases: word separator (≤ 8)Optional

Request example

curl -X POST https://passly.fr/api/v1/generate \
  -H "Content-Type: application/json" \
  -d '{
    "length": 20,
    "count": 3,
    "special": true,
    "exclude_similar": true
  }'

Response

200 OK

{
    "success": true,
    "data": {
        "passwords": [
            "K9#mP2$xQr5@nW8&zF3v",
            "T4*bN7^gH6%jL3!qR9@m",
            "X5&cV8#nB2$kM4@pZ7*w"
        ],
        "entropy_bits": 131.09,
        "strength": "very_strong",
        "metadata": {
            "format": "random",
            "length": 20,
            "charset_size": 88,
            "possible_combinations": 1.7690923e+38,
            "possible_combinations_log10": 38.248
        },
        "crack_time": {
            "seconds": 8.8454615e+25,
            "formatted": "billions of years",
            "unit": "billion_years",
            "value": null,
            "assumptions": "1e+12 guesses/second"
        },
        "generated_at": "2026-01-15T10:30:45.000Z",
        "locale": "fr",
        "api_version": "v1"
    }
}

Rate limiting

A per-IP quota protects the service. The headers tell you where you stand.

Limit per IP

120 requests every 10 minutes

Response headers

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

Error 429

Returned when the limit is reached. The Retry-After header indicates how long to wait.

Error codes

Every error returns JSON with a constant shape and an actionable code.

400Bad Request

Invalid or missing parameters

{
    "error": true,
    "message": "Length must be between 4 and 128 characters",
    "code": "invalid_length"
}

429Too Many Requests

Rate limit exceeded

{
    "error": true,
    "message": "Rate limit reached. Please wait 234 seconds",
    "retry_after": 234,
    "reset_at": "2026-01-15T10:35:00.000Z"
}

500Internal Server Error

Internal server error

{
    "error": true,
    "message": "An error occurred. Please try again."
}

503Service Unavailable

Service under maintenance

{
    "error": true,
    "message": "The site is currently under maintenance. Please try again in a few minutes."
}

Codes returned in the code field

invalid_length
invalid_count
invalid_format
invalid_words
no_charset
empty_wordlist

Integration examples

The same call, in the language of your choice. Copy, paste, adapt.

// PasslyClient.js
class PasslyClient {
    constructor(baseURL = 'https://passly.fr/api/v1') {
        this.baseURL = baseURL;
    }

    async generatePassword(options = {}) {
        const response = await fetch(`${this.baseURL}/generate`, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
                length: options.length || 16,
                count: options.count || 1,
                lowercase: options.lowercase !== false,
                uppercase: options.uppercase !== false,
                digits: options.digits !== false,
                special: options.special || false,
                exclude_similar: options.excludeSimilar || false,
                format: options.format || 'random'
            })
        });

        if (!response.ok) {
            throw new Error(`API Error: ${response.status}`);
        }

        return response.json();
    }

    async checkHealth() {
        const response = await fetch(`${this.baseURL}/health`);
        return response.json();
    }
}

// Utilisation
const passly = new PasslyClient();

const result = await passly.generatePassword({
    length: 24,
    special: true,
    excludeSimilar: true
});

console.log('Mot de passe:', result.data.passwords[0]);
console.log('Force:', result.data.strength);
console.log('Entropie:', result.data.entropy_bits, 'bits');