Security Tools API

What it does

Security Utilities gives you a small set of security-focused endpoints for working with passwords, hashes, and JWTs. Send a password, token, or text value and get back the specific security result you need in a machine-readable response.

Use the password generator to create a password with a chosen length from 4 to 128 characters, plus optional numbers, symbols, lowercase letters, and uppercase letters. It returns the generated password, an estimated strength, and the tool name. Use the password strength checker when you already have a password and want a scored assessment, a strength label, approximate entropy in bits, and feedback strings that point out what to improve.

For text integrity checks, the hash endpoint accepts a text string and an optional algorithm of md5, sha1, sha256, sha384, or sha512, then returns the selected algorithm and the lowercase hexadecimal hash. For token inspection, the JWT decoder accepts a token string and returns the decoded header, payload, and signature along with validity fields such as valid, wellFormed, status, signatureVerified, issues, algorithm, and evaluatedAt. Time-based JWT fields are surfaced when present, including exp, iat, and nbf-related values.

Security Utilities fits into signup flows, admin tools, content pipelines, and debugging workflows where you need quick validation or deterministic security output without building the parsing logic yourself.

▣ ENDPOINT 01 / 04

POST

Secure Password Generator

https://api.eu.apyhub.com/freedailypro/security-tools-api/text/password

QUICKSTART

GUIDE

Quickstart

Generate a new password by sending the minimum required settings in the request body.

curl -X POST "https://api.eu.apyhub.com/freedailypro/security-tools-api/text/password" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"length":12,"numbers":true,"symbols":true,"lowercase":true,"uppercase":true}'

What you'll get back

Returns a JSON object with three string fields: tool is the name of the tool that produced the response, password is the generated password, and strength is the estimated password strength.

{
  "tool": "security-tools-api",
  "password": "V7m!q2Lx9Pz#",
  "strength": "strong"
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Generates a secure password from the provided options, returning the generated password, an estimated strength, and the tool name used to produce the response.

Request Body

Parameter	Type	Mandatory	Description
length	Number	No	Password length. Minimum 4, maximum 128.
numbers	Boolean	No	Whether to include numbers.
symbols	Boolean	No	Whether to include symbols.
lowercase	Boolean	No	Whether to include lowercase letters.
uppercase	Boolean	No	Whether to include uppercase letters.

Response

Returns a JSON object with tool, password, and strength string fields. tool identifies the tool that produced the response, password contains the generated password, and strength contains its estimated strength.

Parameter	Type	Mandatory	Description
tool	String	Yes	Name of the tool that produced the response.
password	String	Yes	The generated password.
strength	String	Yes	Estimated strength of the generated password.

▣ ENDPOINT 02 / 04

POST

Password Strength Checker

https://api.eu.apyhub.com/freedailypro/security-tools-api/security/password-strength

QUICKSTART

GUIDE

Quickstart

Check how strong a password is by sending it in a JSON body.

curl -X POST "https://api.eu.apyhub.com/freedailypro/security-tools-api/security/password-strength" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"password":"CorrectHorseBatteryStaple123!"}'

What you'll get back

Returns a JSON object with a tool string and a result object. The result object contains score as a number from 0 to 4, label as a strength word, entropyBitsApprox as an estimated entropy value, and feedback as an array of strings with improvement tips.

{
  "tool": "password-strength",
  "result": {
    "score": 4,
    "label": "Very Strong",
    "entropyBitsApprox": 120,
    "feedback": []
  }
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Checks the strength of a submitted password and returns an analysis object with a score, label, entropy estimate, and feedback tips.

Request Body

Parameter	Type	Mandatory	Description
password	String	Yes	The password to evaluate.

Response

Returns a JSON object with a tool string field and a result object field. The result object contains the password strength analysis, including score, label, entropyBitsApprox, and feedback.

Parameter	Type	Mandatory	Description
tool	String	Yes	Name of the tool that produced the response.
result	Object	Yes	Strength analysis object containing the fields below.
result.label	String	Yes	Strength as a word, for example `Weak` or `Very Strong`.
result.score	Number	Yes	Strength score from 0 (very weak) to 4 (very strong).
result.feedback	String Array	Yes	Tips to make the password stronger. Empty when no changes are needed.
result.entropyBitsApprox	Number	Yes	Approximate entropy in bits; higher is harder to guess.

▣ ENDPOINT 03 / 04

POST

Text Hash Generator (MD5, SHA)

https://api.eu.apyhub.com/freedailypro/security-tools-api/security/hash

QUICKSTART

GUIDE

Quickstart

Hash a text value with the default MD5 algorithm.

curl -X POST "https://api.eu.apyhub.com/freedailypro/security-tools-api/security/hash" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text":"hello world"}'

What you'll get back

Returns a JSON object with tool, algorithm, and result fields. tool is the name of the tool that produced the response, algorithm is the hash algorithm used, and result is the lowercase hexadecimal hash string.

{
  "tool": "security-tools-api",
  "algorithm": "md5",
  "result": "5eb63bbbe01eeed093cb22bb8f5acdc3"
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Generates a hash for the provided text using the selected algorithm. It accepts a text string and returns the tool name, the algorithm used, and the resulting lowercase hexadecimal hash.

Request Body

Parameter	Type	Mandatory	Description
text	String	Yes	The input text to hash.
algorithm	ENUM	No	Hash algorithm to use. Allowed values: `md5`, `sha1`, `sha256`, `sha384`, `sha512`. Default is not specified in the schema.

Response

Returns a JSON object with tool, algorithm, and result string fields. The tool field identifies the tool that produced the response, algorithm indicates which hash algorithm was used, and result contains the hash as a lowercase hexadecimal string.

Parameter	Type	Mandatory	Description
tool	String	Yes	Name of the tool that produced the response.
algorithm	String	Yes	The hash algorithm that was used.
result	String	Yes	The hash as a lowercase hexadecimal string.

▣ ENDPOINT 04 / 04

POST

JWT Decoder & Inspector

https://api.eu.apyhub.com/freedailypro/security-tools-api/security/jwt-decode

QUICKSTART

GUIDE

Quickstart

Decode a JWT by sending the token in a JSON body.

curl -X POST "https://api.eu.apyhub.com/freedailypro/security-tools-api/security/jwt-decode" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMyIsImV4cCI6MTczNTY4OTYwMH0.signature"}'

What you'll get back

Returns a JSON object with the JWT evaluation result and decoded parts. The response includes top-level fields like tool, valid, wellFormed, status, signatureVerified, issues, header, payload, signature, evaluatedAt, and algorithm, plus time-related fields such as expired, expiresAt, issuedAt, notBefore, notYetValid, secondsUntilExpiry, and unsigned when applicable.

{
  "tool": "jwt-decode",
  "valid": true,
  "wellFormed": true,
  "status": "ok",
  "signatureVerified": false,
  "issues": [],
  "header": {},
  "payload": {},
  "signature": "signature",
  "evaluatedAt": "2026-11-11T00:00:00Z",
  "algorithm": "HS256"
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Decodes and inspects a JWT from the request body, then returns the parsed header, payload, signature, and validation metadata about structure and time-based claims. It does not verify the signature against a key.

Request Body

Parameter	Type	Mandatory	Description
token	String	Yes	The JWT string to decode and inspect.

Response

Returns a JSON object with required fields for the inspection result: tool string, valid boolean, wellFormed boolean, status string, signatureVerified boolean, issues array of strings, header object, payload object, signature string, evaluatedAt string, and algorithm string. The response also includes optional time- and claim-related fields when present in the token, such as expired, expiresAt, issuedAt, notBefore, notYetValid, secondsUntilExpiry, and unsigned.

Parameter	Type	Mandatory	Description
tool	String	Yes	Name of the tool that produced the response.
valid	Boolean	Yes	`true` only if the token is well formed, signed, and within its time limits. The signature itself is not verified.
wellFormed	Boolean	Yes	`true` if the token has three parts that decode to JSON.
status	String	Yes	Overall result: `ok`, `expired`, `not_yet_valid`, `unsigned`, or `malformed`.
signatureVerified	Boolean	Yes	Always `false`: the signature is not checked against a key.
issues	String Array	Yes	Plain-language warnings about the token.
header	Object	Yes	Decoded token header.
payload	Object	Yes	Decoded token payload (claims).
signature	String	Yes	The signature part of the token, as sent.
evaluatedAt	String	Yes	Time the token was checked, in ISO 8601 (UTC).
algorithm	String	Yes	Signing algorithm from the header.
expired	Boolean	No	`true` if the expiry time has passed. Present only if the token has `exp`.
expiresAt	String	No	Expiry time (`exp`) in ISO 8601. Present only if the token has `exp`.
issuedAt	String	No	Issued-at time (`iat`) in ISO 8601. Present only if the token has `iat`.
notBefore	String	No	Not-before time (`nbf`) in ISO 8601. Present only if the token has `nbf`.
notYetValid	Boolean	No	`true` if the not-before time is still in the future. Present only if the token has `nbf`.
secondsUntilExpiry	Number	No	Seconds until the token expires; negative if it already has. Present only if the token has `exp`.
unsigned	Boolean	No	`true` if the header says `alg: none`. Present only for unsigned tokens.

Notes

signatureVerified is always false, so this endpoint is for decoding and inspection rather than cryptographic verification. The valid flag can still be false even when the token is structurally well formed, depending on time-based checks and whether the token is signed.

▣ COMMON ERRORS

Errors any endpoint can return

400bad_request

Required parameter missing or malformed body.

401unauthorized

API key missing, revoked, or not authorized for this service.

429rate_limited

Your plan's per-second rate exceeded. Retry with exponential backoff.

503upstream_busy

Backend temporarily unavailable. Try again in a few seconds.

Similar APIs

Closest matches in the catalog based on this service.

CALLGenerate/Score Password APInick creighton CALLGenerate Password APIDosvak LLC CALLCheck Password Strength APIDosvak LLC CALLGenerate Hash APIDosvak LLC

From the blog

Reads that touch this API.

7 Essential API Security Best Practices for DevelopersJul 9, 2026 Full Site Audit API – Page-Level SEO, Security, and Mobile Checks in One CallJul 9, 2026 Email Validation API: How It Works + 7 Options ComparedSep 24, 2026 Building a DNS Email Validation Service with Cloudflare Workers & ApyHub APIJul 9, 2026