Password Audit API

Know if a password
is actually secure.

Bastion analyses passwords and returns strength scores, crack time estimates, entropy, and real breach data. Without ever storing, logging, or exposing the raw password.

Get started on RapidAPI Try the Demo View on GitHub

What you get back

⚡
Strength Score

0–4 score and human-readable label (Very Weak → Very Strong) using the zxcvbn algorithm.

⏱
Crack Time Estimates

Estimated crack times across four attack scenarios. Throttled/Unthrottled online and fast/slow offline.

🔎
Breach Detection

Checks the HaveIBeenPwned database via k-anonymity. Only a partial hash is ever sent.

💡
Actionable Feedback

Warnings and suggestions grounded in how passwords actually get cracked. Not just "add a symbol".

Response shape

Everything you need,
nothing you don't.

A single POST to /v1/evaluate returns a complete picture of a password's security. Breach checking is optional. Use ?hibp=false to skip it.

Available now on RapidAPI. Native keys available directly (free tier includes 100 requests per day).

Rust + WASM Cloudflare Workers zxcvbn HaveIBeenPwned AGPL v3
// POST /v1/evaluate // { "password": "hunter2" } { "score": 1, "strength": "Weak", "entropy_bits": 12.97244, "crack_times": { "online_throttled": "3 days", "online_unthrottled": "13 minutes", "offline_slow_hash": "less than a second", "offline_fast_hash": "less than a second" }, "breached": true, "breach_count": 65744, "warning": "This is a very common password.", "suggestions": [ "Add another word or two. Uncommon words are better." ] }

Security practices

  • Raw passwords are never stored, logged, or transmitted to any third party
  • Breach checks use k-anonymity. Only the first 5 characters of a SHA-1 hash are sent to HaveIBeenPwned
  • Passwords are zeroed from memory immediately after processing
  • Email addresses are hashed before storage and used only for key regeneration
  • API keys and regeneration tokens are hashed before storage
  • IP addresses used for demo rate limiting are hashed and are deleted after 24 hours