PW Forge 🔐 — Cryptographically Secure Password Generator

Enterprise-grade password generation with entropy calculation, character set control, ambiguity exclusion, and bulk generation up to 100 passwords.

Weak passwords remain the leading cause of account compromise in 2026. PW Forge eliminates the guesswork by generating cryptographically strong passwords using Python's secrets.SystemRandom module — not the predictable random module. Every password comes with detailed statistics: bits of entropy, alphabet size, character type distribution, and strength indicators — so you can verify security guarantees programmatically.

Configure every aspect of password composition: toggle uppercase, lowercase, digits, and special characters independently; exclude visually ambiguous characters (il1Lo0O!|) to reduce transcription errors; set minimum guarantees for each character type to comply with password policies; and generate up to 100 passwords in a single call. Output in JSON (with full stats), CSV (for spreadsheet import), or plain text (for direct copy-paste).

---

✨ Features

• Cryptographically secure generation — Uses secrets.SystemRandom backed by the OS cryptographic random number generator (/dev/urandom) — never the deterministic random module
• Entropy calculation — Every password includes bits of entropy calculated using the standard formula: length × log₂(alphabet_size). Higher entropy = stronger password
• Character set toggles — Independent on/off controls for uppercase (A-Z), lowercase (a-z), digits (0-9), and special characters (!@#$%^&*()-_=+[]{}|;:,.<>?/~`)
• Ambiguity exclusion — Remove visually similar characters (i, l, 1, L, o, 0, O, !, |) to reduce human transcription errors when passwords must be read or typed manually
• Minimum character guarantees — Default configuration ensures at least 1 uppercase, 1 lowercase, 1 digit, and 1 special character, making every password comply with NIST-style composition requirements
• Bulk generation — Generate up to 100 passwords in a single run; each password is independently generated with cryptographic randomness
• Multiple output formats — json (default, includes full stats per password), csv (password, entropy_bits, length), or plain (one password per line)
• Configurable length — Passwords from 4 to 256 characters, with a sensible default of 24 characters providing ~140 bits of entropy
• Detailed password stats — Each generated password includes length, entropy bits, alphabet size, character type presence flags, and charset description
• Audit metadata — Output includes a meta block with count, length, and full configuration snapshot for reproducibility

🚀 Quick Start

Generate One Strong Password

Input:

{
  "length": 24,
  "count": 1
}

Response:

{
  "passwords": [
    {
      "password": "Kx9!mP4#vR7@nQ2&wT5*eX8!",
      "stats": {
        "length": 24,
        "entropy_bits": 139.72,
        "alphabet_size": 72,
        "has_upper": true,
        "has_lower": true,
        "has_digit": true,
        "has_symbol": true,
        "charset": "upper lower digits symbols"
      }
    }
  ],
  "meta": {
    "count": 1,
    "length": 24,
    "config": {
      "uppercase": true,
      "lowercase": true,
      "digits": true,
      "symbols": true,
      "exclude_ambiguous": true
    }
  }
}

Generate 5 Passwords with Custom Length

Input:

{
  "length": 32,
  "count": 5,
  "symbols": true,
  "exclude_ambiguous": true
}

Legacy Input Field Names

For backward compatibility, the actor also accepts these field name variants:

Input:

{
  "length": 16,
  "count": 10,
  "useUppercase": true,
  "useLowercase": true,
  "useDigits": true,
  "useSpecial": true
}

Minimal Password (Digits Only)

Input:

{
  "length": 8,
  "count": 3,
  "uppercase": false,
  "lowercase": false,
  "digits": true,
  "symbols": false,
  "exclude_ambiguous": false
}

Plain Text Output

Input:

{
  "length": 16,
  "count": 4,
  "outputFormat": "plain"
}

Response:

{
  "passwords": [...],
  "meta": {...},
  "_formatted": "aB3!xY7#qW2$vR9\npQ5*mN8@jK1&fD4\nzX6-cV3+bN7=eW0\nhJ2?gF5%tR8_yU1",
  "_format": "plain"
}

📋 Input Parameters

Parameter	Type	Default	Description
length	integer	24	Password length in characters (4–256). Longer = stronger.
count	integer	1	Number of passwords to generate (1–100).
uppercase	boolean	true	Include uppercase letters (A–Z) in the character set.
lowercase	boolean	true	Include lowercase letters (a–z) in the character set.
digits	boolean	true	Include digits (0–9) in the character set.
symbols	boolean	true	Include special characters (!@#$%^&*()-_=+[]{};|;:,.<>?/~`) in the character set.
exclude_ambiguous	boolean	true	Remove visually similar characters: i l 1 L o 0 O ! |
outputFormat	string	"json"	Output format: json (full stats per password), csv (password,entropy,length), or plain (one password per line).

Legacy Alias Fields

The actor also accepts these alternative field names (mapped internally to the primary fields above):

Legacy Field	Maps To
useUppercase	uppercase
useLowercase	lowercase
useDigits	digits
useSpecial	symbols

📤 Output Format

Each run produces a single dataset item containing all generated passwords:

Field	Type	Description
passwords	array	Array of password objects, each containing password (string) and stats (object)
passwords[].password	string	The generated password text
passwords[].stats.length	integer	Password length in characters
passwords[].stats.entropy_bits	number	Bits of entropy (higher = stronger)
passwords[].stats.alphabet_size	integer	Size of the character alphabet used
passwords[].stats.has_upper	boolean	Whether the password contains at least one uppercase letter
passwords[].stats.has_lower	boolean	Whether the password contains at least one lowercase letter
passwords[].stats.has_digit	boolean	Whether the password contains at least one digit
passwords[].stats.has_symbol	boolean	Whether the password contains at least one special character
passwords[].stats.charset	string	Human-readable charset description (e.g. "upper lower digits symbols")
meta	object	Metadata including count, length, and config (snapshot of all input parameters used)
meta.count	integer	Number of passwords generated
meta.length	integer	Password length setting
meta.config	object	Full input configuration snapshot for reproducibility
_formatted	string	Formatted output string (only present when outputFormat is csv or plain)
_format	string	Format indicator: "csv" or "plain" (only present when outputFormat is not json)

📖 Usage Examples

cURL (Apify API)

# Generate 3 passwords of length 32
curl -X POST "https://api.apify.com/v2/acts/perryay~pw-forge/runs" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{"length": 32, "count": 3, "symbols": true, "exclude_ambiguous": true}'

# Generate 10 passwords as plain text
curl -X POST "https://api.apify.com/v2/acts/perryay~pw-forge/runs" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{"length": 20, "count": 10, "outputFormat": "plain"}'

Python (Apify SDK)

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")

result = client.actor("perryay~pw-forge").call(
    run_input={
        "length": 32,
        "count": 5,
        "symbols": True,
        "exclude_ambiguous": True,
    }
)
dataset = client.dataset(result["defaultDatasetId"]).list_items()
for item in dataset.items:
    for pw_entry in item.get("passwords", []):
        pw = pw_entry["password"]
        stats = pw_entry["stats"]
        print(f"Password: {pw}")
        print(f"  Length: {stats['length']}, Entropy: {stats['entropy_bits']} bits")
        print(f"  Charset: {stats['charset']}")
        print()

JavaScript / Node.js (Apify SDK)

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });

const result = await client.actor('perryay~pw-forge').call({
  length: 32,
  count: 5,
  symbols: true,
  exclude_ambiguous: true,
});

const { items } = await client.dataset(result.defaultDatasetId).listItems();
for (const item of items) {
  for (const pwEntry of item.passwords) {
    console.log(`Password: ${pwEntry.password}`);
    console.log(`  Length: ${pwEntry.stats.length}, Entropy: ${pwEntry.stats.entropy_bits} bits`);
    console.log(`  Charset: ${pwEntry.stats.charset}`);
  }
}

🎯 Use Cases

• User account creation flows — Generate strong, policy-compliant initial passwords during user registration, password reset, or bulk account provisioning
• Development and staging environments — Populate test databases with realistic but non-production credentials that still meet security requirements
• API key and token generation — Create high-entropy API keys, client secrets, and application tokens that resist brute-force attacks
• Password policy validation — Use the detailed stats to verify that generated passwords meet your organization's minimum entropy and composition requirements before deployment
• CI/CD secret generation — Integrate into pipeline scripts to generate temporary credentials for build-time secrets, database passwords in ephemeral environments, or signing keys
• Password manager export testing — Generate bulk password sets to test password manager import/export functionality with realistic data
• Security awareness training — Demonstrate password strength concepts (entropy, character sets, length vs. complexity tradeoffs) with real, configurable examples
• Configuration file bootstrapping — Generate initial admin passwords, database credentials, and service account secrets during infrastructure provisioning

❓ FAQ

Q: How is entropy calculated? A: Entropy is calculated using the standard information-theoretic formula: E = L × log₂(A) where L is password length and A is the alphabet size (number of unique characters available). A 24-character password using all four character sets (72 unique chars) yields approximately 148 bits of entropy.

Q: How does this differ from Math.random() or random module generators? A: PW Forge uses secrets.SystemRandom, which draws randomness from the operating system's cryptographically secure random number generator (/dev/urandom on Linux, BCryptGenRandom on Windows). The standard random module uses the Mersenne Twister PRNG, which is predictable and should never be used for security-sensitive applications.

Q: What characters are excluded when exclude_ambiguous is enabled? A: The ambiguous character set is: i, l, 1, L, o, 0, O, !, |. These characters are commonly confused when reading or transcribing passwords in fonts where they look similar (e.g., lowercase l and uppercase I, zero 0 and capital O).

Q: What is a good entropy target? A: NIST recommends at least 128 bits of entropy for high-security applications. A 24-character password using all four character sets (~148 bits) exceeds this threshold. For general-purpose use, 80-100 bits (16-20 characters) is typically sufficient.

Q: Can I generate passwords that meet specific corporate policy requirements? A: Yes. The character set toggles (uppercase, lowercase, digits, symbols) and the minimum guarantee logic ensure every password includes at least one character from each enabled set. You can enforce a minimum of 1 per type by design.

Q: What happens if I disable all character sets? A: If all sets are disabled, the actor defaults to using lowercase letters + digits to ensure every generated password is actually usable.

Q: Is the output suitable for production use? A: Absolutely. The underlying secrets.SystemRandom module is the same CSPRNG used by Python's standard library for token generation (secrets.token_hex, secrets.token_urlsafe). The passwords are suitable for production credentials, API keys, and authentication tokens.

Q: How should I store generated passwords? A: After generation, store passwords in a password manager, encrypted vault, or hashed format (bcrypt, argon2). Never store plaintext passwords in version control, logs, or unencrypted configuration files. The Apify dataset is encrypted at rest, but you should export and delete sensitive data after use.

Q: What is the difference between json and csv output formats? A: json returns the full data structure including all stats for every password, ideal for programmatic consumption. csv returns a simplified format with password, entropy_bits, length per row, suitable for spreadsheet import.

🛠 Tips & Best Practices

• Target 128+ bits of entropy — For production credentials, aim for at least 128 bits of entropy. A 24-character password using all four character sets achieves this comfortably. Increase length rather than alphabet size for the most efficient entropy gains.
• Enable ambiguity exclusion for human-readable passwords — If passwords will be read aloud, typed manually, or printed, always set exclude_ambiguous: true to prevent costly transcription errors.
• Disable symbols for non-technical users — Many users struggle with special characters in Wi-Fi passwords, meeting room codes, or temporary credentials. Consider setting symbols: false for these contexts while keeping length high (28+ characters) to maintain entropy.
• Batch generate for credential rotation — Use count: 100 during scheduled credential rotation cycles and distribute the generated passwords through your secure secrets management system.
• Use plain output for direct injection — When pipelining passwords into configuration files or environment variables, set outputFormat: "plain" to get clean, one-per-line output without JSON wrapping.
• Always set a reasonable minimum length — Never go below length: 12 for production use. Shorter passwords, even with full character sets, have insufficient entropy (< 72 bits) for security-sensitive applications.
• Combine with password strength testing — After generating passwords, run them through a password strength estimator (e.g., zxcvbn) to validate against common patterns and dictionary attacks — entropy alone doesn't catch sequential or repeat patterns.

🔐 Security Guarantees

Property	Guarantee
Random source	secrets.SystemRandom (OS CSPRNG)
Reproducibility	No — each run generates unique passwords
In-memory handling	Passwords returned only in API response
Transmission	TLS-encrypted (Apify API)
At-rest encryption	Apify dataset encrypted at rest
Predictability	Not predictable — CSPRNG cannot be seeded
Minimum uniqueness	At least 1 character from each enabled type

📊 Entropy Reference Table

Choosing the right password length depends on your security requirements. The table below shows entropy values for various lengths using all four character sets (72 character alphabet):

Length	Entropy (bits)	Strength	Example Use Case
8	49.5	Weak	Quick temporary codes
12	74.2	Moderate	Low-risk application access
16	99.0	Strong	Standard user accounts
20	123.7	Very Strong	Admin accounts, API keys
24	148.4	Excellent	Production secrets, SSH keys
32	197.9	Overkill	Master passwords, encryption keys
48	296.8	Extreme	Long-term cryptographic keys
64	395.7	Maximum	Maximum allowed output

---

🔗 Related Tools

Check out other developer utilities by perryay:

Tool	Description
JSON Studio	Format, validate, transform, and diff JSON data with 8 operation modes
QR Craft	Generate high-quality QR codes in PNG or SVG, batch up to 50
UUID Lab	Generate UUID v4/v7, NanoID, Short ID, and ULID identifiers
Domain Intel	WHOIS, DNS, and SSL lookup for domain intelligence
Meta Mate	Extract Open Graph, Twitter Cards, and JSON-LD metadata
IP Geo	Multi-provider IP geolocation with ISP detection
URL Health	Check URL accessibility, redirects, and SSL health
PW Forge	Generate secure passwords with entropy calculation
TZ Mate	Convert timezones and check DST offsets
Regex Lab	Test and debug regular expressions online
Brand Monitor Lite	Track brand mentions across multiple URLs
Link Quality Analyzer	Detect broken links and audit link quality
Mock Data Generator	Generate realistic test data for development
HTML to Markdown	Convert web pages or HTML to clean Markdown
SSL Cert Inspector	Deep SSL/TLS certificate analysis with scoring