Developers

Strong passwords and self-destructing secret links, from your own code. Simple JSON, CORS enabled, nothing to install.

Get a free API key New to APIs? Start here

Passwords & passphrases

Free, no key needed: up to 10 at a time. Add your free key for up to 100 at a time.

Secure one-time links

You encrypt, we store only scrambled data. Needs a free key you can create below.

Plain JSON over HTTPS

Works from curl, browsers, servers and scripts. CORS is enabled.

New to APIs? Start here

An API is a web address that gives back data instead of a web page. There are three ways to try ours, from easiest to most powerful.

1. In your browser

Making passwords is free and needs no key, so an ordinary link works. Click one and your browser shows the reply. Your passwords are in the "passwords" list.

To choose options, add ? after the address, then join options with &, like https://pass.new/api/v1/password?length=20&count=5. All the options are listed under Requests & responses.

2. In the Terminal

The examples on this page use curl, a small program that asks a web address for data, just as your browser does, but in a text window. For the links above, curl and your browser get exactly the same reply. It's already installed on Macs and on Windows 10 and 11.

Open the Terminal. On a Mac, press Cmd+Space, type Terminal and press Return. On Windows, open the Start menu, type PowerShell and press Enter.
Press Copy on any request below.
Paste it into the Terminal and press Return. The reply appears underneath.

curl "https://pass.new/api/v1/password"

3. With your API key

The secure-link tools need your free API key. Your key can't go in an ordinary link. It travels in a header, a hidden label sent along with the request, which a browser's address bar can't add. That also keeps your key out of your browser history. curl adds a header with -H:

curl "https://pass.new/api/v1/usage" -H "X-API-Key: pn_YOUR_KEY"

curl: The program that sends the request.
"https://pass.new/api/v1/usage": The address to ask. This one tells you how many requests your key has left, and doesn't use any.
-H "X-API-Key: pn_YOUR_KEY": Your key. Replace pn_YOUR_KEY with your own key and keep the quotes, or fill it in below.

Your API key (optional)

Paste your key here and every example on this page uses it, ready to copy. It stays on this page: it isn't saved or sent anywhere, and it's gone when you leave.

For the geeks: Windows and multi-line commands

Some examples are split over several lines with a \ at the end of each line. That works in the Mac and Linux Terminal. On Windows, the Copy buttons give you a one-line version that uses curl.exe, because in Windows PowerShell plain curl runs a different command.

Requests with a JSON body (-d '{…}') are easiest from the Mac or Linux Terminal, or from code: see the JavaScript and Python tabs further down.

Get a free API key

Create your own key right here. It takes a few seconds, and you don’t need to ask us. Free keys include 100 requests to the secure-link API. Password generation needs no key at all.

Your key is created in your browser. We store only a fingerprint (SHA-256), so not even we can read it.
It's delivered with our own tech: a one-time secure link that self-destructs after you open it (or after 24 hours).
Need more than 100 requests? Email api@pass.new.

Requests & responses

Every example below is a real request with the reply you'll get back. Press Copy to paste a request into your Terminal, or Open in browser where there's no key involved. Base URL: https://pass.new

Using an AI assistant or API tool? Point it at pass.new/llms.txt (a plain-English guide) or pass.new/openapi.json (the full API description, OpenAPI 3.1).

GET `/api/v1/password`

Generate passwords or passphrases. Free, and no key needed for everyday use. Add your free API key for bigger batches and a higher rate limit. Password requests never use up your key's 100 secure-link requests.

	Passwords per request	Requests per minute
No key	Up to 10	60, per IP address
With your free key	Up to 100	300, per key

Param	Default	Description
`length`	16	8 to 64 characters
`uppercase`	true	Mix in capital letters (at least one). `false` gives lowercase letters only
`numbers`	true	Include at least one digit
`symbols`	true	Include at least one of `! @ # $ % & * - _ + = ?`
`passphrase`	false	Words from the EFF short list, hyphenated, plus a two-digit number
`words`	5	4 to 6 words (passphrase mode only)
`count`	1	How many to make: 1 to 10, or 1 to 100 with your API key

A single password (defaults)

Request

curl "https://pass.new/api/v1/password"

Response 200 OK

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59

{
  "passwords": ["W%Q5*%t#3Yeqm?YA"],
  "entropy_bits": 99.4,
  "options": {
    "passphrase": false,
    "length": 16,
    "uppercase": true,
    "numbers": true,
    "symbols": true
  }
}

Three 24-character passwords without symbols

Request

curl "https://pass.new/api/v1/password?length=24&symbols=false&count=3"

Response 200 OK

{
  "passwords": [
    "j7Ibk4QMojfdG12T1EboOmvP",
    "a9ZxcXAHI4KJMOr7qFt2iWcc",
    "xE3o7xY2XfOcrDEVmiEY2fPd"
  ],
  "entropy_bits": 142.9,
  "options": {
    "passphrase": false,
    "length": 24,
    "uppercase": true,
    "numbers": true,
    "symbols": false
  }
}

Memorable passphrases

Request

curl "https://pass.new/api/v1/password?passphrase=true&words=4&count=2"

Response 200 OK

{
  "passwords": [
    "curl-owl-hut-chief-77",
    "pep-tall-heat-rank-64"
  ],
  "entropy_bits": 47.9,
  "options": { "passphrase": true, "words": 4 }
}

100 passwords at once, with your key

Request

curl "https://pass.new/api/v1/password?count=100" -H "X-API-Key: pn_YOUR_KEY"

Response 200 OK

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 299

{
  "passwords": ["k#8Tq2vM!xR4pLw9", "…98 more…", "Zf3@nB7c-Yh1sQe5"],
  "entropy_bits": 99.4,
  "options": { … }
}

Without a key, asking for more than 10 returns 400 with a message saying how to add your key.

POST `/api/v1/secrets`

Create a self-destructing link for a password or any other secret, just like the “Send it securely” button on our homepage. You encrypt the secret in your own code first, so we only ever store scrambled data.

Needs your free API key, sent in an X-API-Key header. Get one above in a few seconds; there’s no need to email us. Each call uses one of your 100 requests.

Field	Default	Description
`ciphertext`	(required)	base64url of the 12-byte IV followed by the AES-256-GCM output. Max 64 KB.
`ttl`	86400	Seconds until it expires: `3600` (1 hour), `86400` (24 hours) or `604800` (7 days)
`views`	1	How many times it can be opened, 1 to 10

Create a one-time link

Request

curl -X POST "https://pass.new/api/v1/secrets" \
  -H "X-API-Key: pn_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ciphertext":"q1Xr0v8cJ3mZ2kP9aT4wY7bN6hL5eD0fG1sU3iO8","ttl":3600,"views":1}'

Response 201 Created

X-API-Key-Limit: 100
X-API-Key-Remaining: 99

{
  "id": "XA4oKaLHtmuWcUj4Q6FbPQ",
  "url": "https://pass.new/s/XA4oKaLHtmuWcUj4Q6FbPQ",
  "expires_at": "2026-09-27T21:40:50.462Z",
  "views": 1
}

Share url + # + your base64url key, e.g. https://pass.new/s/XA4oKaLHtmuWcUj4Q6FbPQ#Gk2…. The part after # never reaches our server. Anyone can open the link in a browser; they don't need a key.

GET `/api/v1/secrets/:id`

Read a secret back in your own code. This uses up one view, and the secret is deleted after its last view. People opening the link in a browser don’t need a key. Needs your API key in the X-API-Key header.

First read

Request

curl "https://pass.new/api/v1/secrets/XA4oKaLHtmuWcUj4Q6FbPQ" \
  -H "X-API-Key: pn_YOUR_KEY"

Response 200 OK

{
  "ciphertext": "q1Xr0v8cJ3mZ2kP9aT4wY7bN6hL5eD0fG1sU3iO8",
  "views_remaining": 0,
  "expires_at": "2026-09-27T21:40:50.462Z"
}

Reading it again

Response 404 Not Found

{
  "error": "not_found",
  "message": "This secret does not exist, has expired, or was already viewed"
}

POST `/api/v1/canaries`

Create a canary: a decoy password and a trap link that alert you when used. Plant the password as a fake account in your own system, or the link anywhere a snooper might look. Needs your API key.

Field	Description
`label`	Optional name, shown in alerts
`webhook_url`	https:// URL we POST to when the canary trips
`alert_email`	Email for alerts (we send a confirmation link first)

Request

curl -X POST "https://pass.new/api/v1/canaries" \
  -H "X-API-Key: pn_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Admin decoy","webhook_url":"https://example.com/hooks/canary"}'

Response 201 Created

{
  "id": "pJLm7-d_YYmbafDn",
  "password": "G1eu#r8Tq!mZ4v@Kx2Lp",
  "trap_url": "https://pass.new/c/pJLm7-d_YYmbafDn",
  "manage_url": "https://pass.new/canary/manage#pJLm7-d_YYmbafDn.…",
  "webhook_secret": "wv3iQ…"
}

The password is shown once; we keep only its SHA-256. Webhooks are signed: check that X-PassNew-Signature equals sha256= + the HMAC-SHA256 of the raw body using your webhook_secret.

POST `/api/v1/canaries/check`

Call this from your login code whenever a sign-in fails. If the password is one of your canaries, it trips and alerts you. Only your own key's canaries are checked.

Request

curl -X POST "https://pass.new/api/v1/canaries/check" \
  -H "X-API-Key: pn_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password":"G1eu#r8Tq!mZ4v@Kx2Lp"}'

Response 200 OK

{ "tripped": true, "canary_id": "pJLm7-d_YYmbafDn" }

Webhook we send

POST https://example.com/hooks/canary
X-PassNew-Event: canary.tripped
X-PassNew-Signature: sha256=5f1c…

{
  "event": "canary.tripped",
  "canary": { "id": "pJLm7-d_YYmbafDn", "label": "Admin decoy" },
  "source": "password_check",
  "at": "2026-09-27T22:02:13.000Z",
  "country": "GB",
  "city": "London",
  "ip": "203.0.113.7",
  "user_agent": "Mozilla/5.0 …"
}

GET `/api/v1/usage`

Check how many requests your key has left. This doesn't use any of them.

Request

curl "https://pass.new/api/v1/usage" -H "X-API-Key: pn_YOUR_KEY"

Response 200 OK

{ "limit": 100, "used": 1, "remaining": 99 }

Errors & limits

Errors always come back as JSON with an error code and a readable message.

Status	When	Example body
400	A parameter is out of range, or more than 10 passwords asked for without a key	`{"error":"bad_request","message":"length must be an integer from 8 to 64"}`
401	Missing or unknown API key	`{"error":"unauthorized","message":"Invalid API key"}`
403	Your key has used all its requests	`{"error":"quota_exceeded","message":"This key has used all 100 of its requests. Email api@pass.new for a higher limit."}`
404	Secret expired, already viewed, or never existed	`{"error":"not_found", …}`
429	Too many password requests in a minute (60 without a key, 300 with one). Wait for `Retry-After` seconds.	`{"error":"rate_limited","message":"Limit is 60 requests per minute"}`

Copy-paste examples

Complete flows: generate a password, encrypt it on your side, and create a one-time link.

# One 24-character password
curl "https://pass.new/api/v1/password?length=24"

# Five passphrases
curl "https://pass.new/api/v1/password?passphrase=true&words=5&count=5"

# Store a secret you have already encrypted (see the JavaScript or Python tab)
curl -X POST "https://pass.new/api/v1/secrets" \
  -H "X-API-Key: pn_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ciphertext":"BASE64URL_IV_AND_CIPHERTEXT","ttl":3600,"views":1}'

# How many requests does my key have left?
curl "https://pass.new/api/v1/usage" -H "X-API-Key: pn_YOUR_KEY"

// Generate passwords (no key needed)
const res = await fetch("https://pass.new/api/v1/password?length=20&count=3");
const { passwords } = await res.json();

// Share a secret: encrypt locally, send only the ciphertext
const b64url = (bytes) =>
  btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

const key = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
const iv = crypto.getRandomValues(new Uint8Array(12));
const data = new TextEncoder().encode(passwords[0]);
const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, data));
const rawKey = new Uint8Array(await crypto.subtle.exportKey("raw", key));

const secret = await fetch("https://pass.new/api/v1/secrets", {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-API-Key": "pn_YOUR_KEY" },
  body: JSON.stringify({ ciphertext: b64url(new Uint8Array([...iv, ...ct])), ttl: 3600, views: 1 }),
}).then((r) => r.json());

console.log(`${secret.url}#${b64url(rawKey)}`); // share this link

# pip install requests cryptography
import base64, os, requests
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

# Generate passwords (no key needed)
r = requests.get("https://pass.new/api/v1/password", params={"length": 20, "count": 3})
passwords = r.json()["passwords"]

# Share a secret: encrypt locally, send only the ciphertext
b64url = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=").decode()
key = AESGCM.generate_key(bit_length=256)
iv = os.urandom(12)
ct = AESGCM(key).encrypt(iv, passwords[0].encode(), None)

r = requests.post(
    "https://pass.new/api/v1/secrets",
    headers={"X-API-Key": "pn_YOUR_KEY"},
    json={"ciphertext": b64url(iv + ct), "ttl": 3600, "views": 1},
)
print(r.json()["url"] + "#" + b64url(key))  # share this link

Need more than 100 requests, or something custom?

Email api@pass.new and tell us what you're building.

Developers

New to APIs? Start here

1. In your browser

2. In the Terminal

3. With your API key

Get a free API key

Requests & responses

GET /api/v1/password

A single password (defaults)

Three 24-character passwords without symbols

Memorable passphrases

100 passwords at once, with your key

POST /api/v1/secrets

Create a one-time link

GET /api/v1/secrets/:id

First read

Reading it again

POST /api/v1/canaries

POST /api/v1/canaries/check

GET /api/v1/usage

Errors & limits

Copy-paste examples

GET `/api/v1/password`

POST `/api/v1/secrets`

GET `/api/v1/secrets/:id`

POST `/api/v1/canaries`

POST `/api/v1/canaries/check`

GET `/api/v1/usage`