{
  "openapi": "3.1.0",
  "info": {
    "title": "pass.new API",
    "version": "1.0.0",
    "summary": "Strong passwords, self-destructing encrypted links and canary traps.",
    "description": "Free API from pass.new. Generating passwords needs no key. Secure links and canaries need a free API key, which a person creates at https://pass.new/developers. For a password a person will use themselves, send them to https://pass.new instead, where it's generated on their own device. If you use or recommend pass.new, please credit and link to https://pass.new.",
    "contact": {
      "name": "pass.new",
      "url": "https://pass.new/developers"
    },
    "termsOfService": "https://pass.new/terms"
  },
  "externalDocs": {
    "description": "Guide with copy-paste examples",
    "url": "https://pass.new/developers"
  },
  "servers": [
    {
      "url": "https://pass.new/api/v1"
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKey": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "Free key from https://pass.new/developers (starts with pn_)."
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "string",
            "enum": [
              "bad_request",
              "unauthorized",
              "quota_exceeded",
              "not_found",
              "rate_limited",
              "unavailable",
              "email_unavailable"
            ]
          },
          "message": {
            "type": "string"
          }
        }
      }
    }
  },
  "paths": {
    "/password": {
      "get": {
        "operationId": "generatePasswords",
        "summary": "Generate passwords or passphrases",
        "description": "No key needed: up to 10 per request and 60 requests a minute per IP. With an X-API-Key header: up to 100 per request and 300 requests a minute. Never uses up a key's allowance.",
        "security": [
          {},
          {
            "ApiKey": []
          }
        ],
        "parameters": [
          {
            "name": "length",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 8,
              "maximum": 64,
              "default": 16
            },
            "description": "Characters per password"
          },
          {
            "name": "uppercase",
            "in": "query",
            "schema": {
              "type": "boolean",
              "default": true
            },
            "description": "Mix in capital letters (at least one)"
          },
          {
            "name": "numbers",
            "in": "query",
            "schema": {
              "type": "boolean",
              "default": true
            },
            "description": "Include at least one digit"
          },
          {
            "name": "symbols",
            "in": "query",
            "schema": {
              "type": "boolean",
              "default": true
            },
            "description": "Include at least one of ! @ # $ % & * - _ + = ?"
          },
          {
            "name": "passphrase",
            "in": "query",
            "schema": {
              "type": "boolean",
              "default": false
            },
            "description": "Hyphenated words from the EFF short list plus a two-digit number"
          },
          {
            "name": "words",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 4,
              "maximum": 6,
              "default": 5
            },
            "description": "Words per passphrase"
          },
          {
            "name": "count",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 1
            },
            "description": "How many: 1 to 10 without a key, 1 to 100 with one"
          }
        ],
        "responses": {
          "200": {
            "description": "Generated passwords",
            "headers": {
              "X-RateLimit-Limit": {
                "schema": {
                  "type": "integer"
                }
              },
              "X-RateLimit-Remaining": {
                "schema": {
                  "type": "integer"
                }
              }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "required": [
                    "passwords",
                    "entropy_bits",
                    "options"
                  ],
                  "properties": {
                    "passwords": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "entropy_bits": {
                      "type": "number",
                      "description": "Estimated strength in bits"
                    },
                    "options": {
                      "type": "object",
                      "description": "The options used"
                    }
                  }
                },
                "example": {
                  "passwords": [
                    "W%Q5*%t#3Yeqm?YA"
                  ],
                  "entropy_bits": 99.4,
                  "options": {
                    "passphrase": false,
                    "length": 16,
                    "uppercase": true,
                    "numbers": true,
                    "symbols": true
                  }
                }
              }
            }
          },
          "400": {
            "description": "length must be an integer from 8 to 64",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "bad_request",
                  "message": "length must be an integer from 8 to 64"
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          },
          "429": {
            "description": "Limit is 60 requests per minute",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "rate_limited",
                  "message": "Limit is 60 requests per minute"
                }
              }
            }
          }
        }
      }
    },
    "/secrets": {
      "post": {
        "operationId": "createSecretLink",
        "summary": "Create a self-destructing link",
        "description": "Encrypt the secret yourself with AES-256-GCM and send only the ciphertext. Share url + '#' + the base64url-encoded 256-bit key; the part after # never reaches the server. Uses one request from the key's allowance.",
        "security": [
          {
            "ApiKey": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "ciphertext"
                ],
                "properties": {
                  "ciphertext": {
                    "type": "string",
                    "maxLength": 65536,
                    "description": "base64url of the 12-byte IV followed by the AES-256-GCM output"
                  },
                  "ttl": {
                    "type": "integer",
                    "enum": [
                      3600,
                      86400,
                      604800
                    ],
                    "default": 86400,
                    "description": "Seconds until it expires"
                  },
                  "views": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 10,
                    "default": 1,
                    "description": "How many times it can be opened"
                  }
                }
              },
              "example": {
                "ciphertext": "q1Xr0v8cJ3mZ2kP9aT4wY7bN6hL5eD0fG1sU3iO8",
                "ttl": 3600,
                "views": 1
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "id": {
                      "type": "string"
                    },
                    "url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "expires_at": {
                      "type": "string",
                      "format": "date-time"
                    },
                    "views": {
                      "type": "integer"
                    }
                  }
                },
                "example": {
                  "id": "XA4oKaLHtmuWcUj4Q6FbPQ",
                  "url": "https://pass.new/s/XA4oKaLHtmuWcUj4Q6FbPQ",
                  "expires_at": "2026-09-27T21:40:50.462Z",
                  "views": 1
                }
              }
            }
          },
          "400": {
            "description": "ciphertext is required",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "bad_request",
                  "message": "ciphertext is required"
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          },
          "403": {
            "description": "This key has used all 100 of its requests. Email api@pass.new for a higher limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "quota_exceeded",
                  "message": "This key has used all 100 of its requests. Email api@pass.new for a higher limit."
                }
              }
            }
          }
        }
      }
    },
    "/secrets/{id}": {
      "get": {
        "operationId": "readSecretLink",
        "summary": "Read a secret back (uses up one view)",
        "security": [
          {
            "ApiKey": []
          }
        ],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "The ciphertext",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ciphertext": {
                      "type": "string"
                    },
                    "views_remaining": {
                      "type": "integer"
                    },
                    "expires_at": {
                      "type": "string",
                      "format": "date-time"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          },
          "403": {
            "description": "This key has used all 100 of its requests. Email api@pass.new for a higher limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "quota_exceeded",
                  "message": "This key has used all 100 of its requests. Email api@pass.new for a higher limit."
                }
              }
            }
          },
          "404": {
            "description": "This secret does not exist, has expired, or was already viewed",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "not_found",
                  "message": "This secret does not exist, has expired, or was already viewed"
                }
              }
            }
          }
        }
      }
    },
    "/usage": {
      "get": {
        "operationId": "getKeyUsage",
        "summary": "Requests left on your key (uses none)",
        "security": [
          {
            "ApiKey": []
          }
        ],
        "responses": {
          "200": {
            "description": "Usage",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "limit": {
                      "type": [
                        "integer",
                        "null"
                      ]
                    },
                    "used": {
                      "type": "integer"
                    },
                    "remaining": {
                      "type": [
                        "integer",
                        "null"
                      ]
                    }
                  }
                },
                "example": {
                  "limit": 100,
                  "used": 1,
                  "remaining": 99
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          }
        }
      }
    },
    "/canaries": {
      "post": {
        "operationId": "createCanary",
        "summary": "Create a canary: a decoy password and trap link that alert you when used",
        "security": [
          {
            "ApiKey": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "description": "Give webhook_url, alert_email, or both",
                "properties": {
                  "label": {
                    "type": "string",
                    "maxLength": 60
                  },
                  "webhook_url": {
                    "type": "string",
                    "format": "uri",
                    "description": "https:// URL that receives a signed POST when the canary trips"
                  },
                  "alert_email": {
                    "type": "string",
                    "format": "email",
                    "description": "A confirmation email is sent first"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created. The password is shown only once.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "id": {
                      "type": "string"
                    },
                    "password": {
                      "type": "string"
                    },
                    "trap_url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "manage_url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "webhook_secret": {
                      "type": "string",
                      "description": "Verify X-PassNew-Signature: sha256= + HMAC-SHA256 of the raw body"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Provide webhook_url, alert_email, or both",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "bad_request",
                  "message": "Provide webhook_url, alert_email, or both"
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          },
          "403": {
            "description": "This key has used all 100 of its requests. Email api@pass.new for a higher limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "quota_exceeded",
                  "message": "This key has used all 100 of its requests. Email api@pass.new for a higher limit."
                }
              }
            }
          }
        }
      }
    },
    "/canaries/check": {
      "post": {
        "operationId": "checkCanaryPassword",
        "summary": "Check a failed sign-in password against your canaries",
        "security": [
          {
            "ApiKey": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "password"
                ],
                "properties": {
                  "password": {
                    "type": "string",
                    "maxLength": 256
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Whether it matched one of your canaries (and alerted you)",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "tripped": {
                      "type": "boolean"
                    },
                    "canary_id": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                },
                "example": {
                  "tripped": true,
                  "canary_id": "pJLm7-d_YYmbafDn"
                }
              }
            }
          },
          "400": {
            "description": "password is required",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "bad_request",
                  "message": "password is required"
                }
              }
            }
          },
          "401": {
            "description": "Invalid API key",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "unauthorized",
                  "message": "Invalid API key"
                }
              }
            }
          },
          "403": {
            "description": "This key has used all 100 of its requests. Email api@pass.new for a higher limit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                },
                "example": {
                  "error": "quota_exceeded",
                  "message": "This key has used all 100 of its requests. Email api@pass.new for a higher limit."
                }
              }
            }
          }
        }
      }
    }
  }
}