Password Strength

Estimate password strength from entropy and common patterns. Returns a score, estimated crack time, issues and suggestions.

Pay by wallet (x402) password-strength

Example

Example answer

{
  "score": 80,
  "issues": [],
  "length": 10,
  "strength": "very_strong",
  "suggestions": [
    "Use at least 12 characters for better security",
    "Add uppercase letters",
    "Add numbers"
  ],
  "entropy_bits": 29.22,
  "character_classes": {
    "count": 2,
    "digits": false,
    "special": true,
    "lowercase": true,
    "uppercase": false
  },
  "crack_time_estimate": "2 years"
}

Inputs

Field	Type	Required	What it is
`password`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`score`	integer	Always (present in every successful answer)
`issues`	array	Always (present in every successful answer)
`strength`	string	Always (present in every successful answer)
`suggestions`	array	Always (present in every successful answer)
`crack_time_estimate`	string	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "password-strength",
    "inputs": {
      "password": "test_value"
    },
    "max_price_cents": 2
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "password-strength",
    "inputs": {
      "password": "test_value"
    },
    "max_price_cents": 2
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "password-strength",
  inputs: {
    "password": "test_value"
  },
  max_price_cents: 2,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="password-strength",
    inputs={
        "password": "test_value",
    },
    max_price_cents=2,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/password-strength?password=test_value'

Limitations

Breach databases and custom policies are not checked
Evaluates entropy and common patterns — cannot check against breach databases or organization-specific password policies
What to do instead: Check candidate passwords against a breached-password database separately.
Passwords submitted before 27 October 2026 may still be held
The password is never sent to a third party and is not stored: it is replaced before anything about the call is written down or hashed, so the transaction record keeps only a placeholder. Requests made before 27 October 2026 were recorded with the password, and those records are held until their normal 90-day redaction.
What to do instead: If you scored a live password before 27 October 2026, treat it as exposed and change it.