A strong password generator is only useful if the randomness is real and the value never leaves the place where it is used. A weak random source can produce predictable strings. A generator that sends the password to a third party adds a trust problem.
The strong password generator returns a random password and its length. With a hash, it can check whether the password appears in a breach list.
curl "https://api2.globus.studio/v2/password?length=20&format=json"What a strong password generator changes
Length matters more than a long list of required character classes. A 20-character random password is stronger than a short password with one symbol. The endpoint accepts a length and uses a mixed character set. Very long values are capped to keep the response predictable.
The breach check
The strong password generator accepts a SHA-1 hash in the check parameter. It compares the hash with a list of known breached passwords and returns a flag. The password itself is not sent. Hashing on the client and sending only the hash keeps the secret out of the request log.
hash=$(printf '%s' 'correct horse battery staple' | sha1sum | cut -d' ' -f1)
curl "https://api2.globus.studio/v2/password?check=$hash&format=json"Storing passwords
Generate the password, show it once and store only a slow hash. PHP has password_hash() with Argon2id or bcrypt. Do not store the SHA-1 hash as the password hash. SHA-1 is fast and unsuitable for storage.
When to generate
Generate a temporary password when an admin creates an account, or when a user asks for a suggestion. Let the user replace it. A generated password that nobody can remember is often written on a note, which is worse than a passphrase.
Limits
A strong password generator does not know your password policy. If a system requires a symbol or forbids one, check the result before you show it. The endpoint is rate limited like the rest of the catalog. Read the endpoint documentation for parameters and response fields.
Passphrases and random strings
A random string is hard to remember and easy to paste into a password manager. A passphrase is easier to type and can be strong with enough words. The generator returns a random string; use it for accounts that are stored in a manager. For a value a person must type, consider a passphrase from a separate tool.
Breach checks without sending the password
To use a strong password generator with a breach list, hash the password locally, send the hash, and compare the flag. The server sees a hash, not the password. A SHA-1 hash is enough for this check because the source list uses SHA-1. Do not use the same hash for storage.
Run the check when the user picks a password, not on every login. A breach list grows over time, so a value that was clean last year may appear today. A scheduled check with a stored hash is more work than most sites need; a check at signup and at password change covers the case that matters.
printf '%s' "$password" | sha1sumRead the endpoint documentation for the parameters and the response.
Entropy and policy
A password’s strength comes from the number of possible values, not from a symbol counter. A 20-character random string has more combinations than a short string with every character class. If a policy forces a symbol, the generator can still meet it, but the policy should not make the password shorter.
Check the generated value against the target system’s rules before you show it. A password that the system rejects is worse than no suggestion.
Related reading
To keep a strong password generator useful, store the result in a manager. For a WordPress site, rotate the salts after a password change. To separate a real login from a script, read detecting bot traffic and parsing User-Agent strings.
Further reading: NIST SP 800-63B, passwords.