ForHosting KIT · Developer Utilities

Generate a password

Weak, reused or predictable passwords are still the fastest way into an account, and hand-rolled random.choice() loops rarely produce truly unpredictable output. This password generator API delegates the job to a cryptographically secure random source and hands back strings built to your exact policy, one call at a time or by the thousand.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Why 'random-looking' isn't random

Most in-house password generators lean on a language's default pseudo-random number generator, which is fast but predictable enough that, given a few outputs, an attacker can sometimes infer future ones. A password meant to protect an account needs entropy sourced from a cryptographically secure generator, not from a PRNG built for simulations or games. That distinction is the entire reason this endpoint exists: it removes the temptation to reach for Math.random() under deadline pressure.

What you control

Each request accepts length, and which character classes to include: lowercase, uppercase, digits, and symbols, plus flags to exclude ambiguous characters like 0/O or l/1/I when passwords will be read aloud or typed by hand. You can request a single password or a batch in one call, which matters when you're provisioning dozens of service accounts, test fixtures, or temporary credentials during an onboarding flow.

How the request flows

Call POST /dev/password-gen with your parameters and the endpoint immediately returns a task_id; the actual generation happens asynchronously on our global edge. You get the result back through a signed webhook, which we recommend for anything automated, or by fetching a signed link that stays valid for 24 hours. Nothing about the request or its output touches training data, and generated values are deleted once the retention window closes.

Where it fits your pipeline

Teams call this endpoint from CI/CD scripts to seed test databases, from admin panels to set temporary credentials for new users, and from infrastructure tooling to rotate service-account secrets on a schedule. Because access requires prepaid balance rather than a rate-limited free tier, the endpoint stays fast and free of the abuse patterns that plague open password generators. A failed generation is never billed: the system retries up to three times before returning a clear error, so you pay only for passwords that actually exist.

What you can do with it

Onboarding new users

Generate a temporary, policy-compliant password at account creation time and email it through your own signed link flow, without ever hand-coding character rules.

Rotating service-account secrets

Schedule a cron job that calls the endpoint monthly to replace database or API credentials, cutting the blast radius if one ever leaks.

Seeding test environments

Request a batch of hundreds of unique passwords in a single call to populate staging fixtures without writing a custom generator for every project.

Enforcing client-specific policies

Generate passwords that satisfy a legacy system's odd rules, like 'no symbols, exactly 12 characters', by simply adjusting the request parameters.

FAQ

Is this password generator API free?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

Is the output actually cryptographically secure?

Yes, passwords are produced with a cryptographically secure random source rather than a standard pseudo-random generator, which is the property that matters for anything protecting real accounts.

Can I generate passwords in bulk?

Yes, a single call to POST /dev/password-gen can request many passwords at once, which is faster and cheaper than looping single requests for bulk provisioning.

Can I exclude confusing characters like 0, O, l and 1?

Yes, an option in the request excludes visually ambiguous characters, useful for passwords that will be read aloud or typed from a printout.

How do I get the generated password back?

The endpoint is asynchronous: it returns a task_id immediately, and the result arrives via a signed webhook or a signed link valid for 24 hours.

What happens if a request fails?

The system retries automatically up to three times; if it still fails you get a clear error and are never charged for that request.

Are generated passwords stored or used for training?

No, generated values are deleted after the retention window and are never used to train any model.

What length and complexity can I set?

You control the exact length and which character classes to include, so you can match anything from a simple 8-character alphanumeric rule to a long symbol-heavy policy.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/password-gen

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/password-gen \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"input":"…"}'

const res = await fetch("https://api.kit.forhosting.com/dev/password-gen", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "input": "…"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/password-gen",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "input": "…"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/password-gen", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"input":"…"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"input":"…"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/password-gen", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "input": "…"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.password_gen",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free