Free scrypt Hash API Endpoint

Call the free scrypt hash API endpoint

curl -X POST https://aisenseapi.com/services/v1/scrypt_hash \
  -H "Content-Type: application/json" \
  -d '{"password":"correct horse battery staple"}'

{"scrypt_hash":"$scrypt$ln=17,r=8,p=1$XRuRTLmjykO/2l6lLaNcPQ$6+BPSBbTvew9wapsGEonhf1PCFK7MPgykUWEqd+OZI8"}

Call it again with the same password and you get a different string: the salt is fresh every time, and that is the point of a password hash. Both strings verify. The field may also be called data, like the rest of the hash family, and a text/plain body works too. There is no file upload here, because a file is not a password.

Use test data. The string is kept by nobody here, but the password travels to a public service over TLS, and a real password belongs to the application that uses it. These routes exist to test, compare and generate fixtures.

Response fields

Field	Type	Description
scrypt_hash	string	The self-describing hash string: algorithm, cost, salt and hash. An empty password is refused with HTTP 400 and a `fix`; one over 1024 bytes with 413.

The parameters are fixed. ln=17 means N = 2^17 = 131072 iterations of the memory-hard mixing, r=8 the block size, p=1 one parallel lane, and the hash is 32 bytes; the memory needed is 128 times N times r bytes, 128 MiB here. On the API box one call takes about 230 ms of one core, the most expensive of the three. The string is the PHC format used by the Rust and Python ecosystems; the $7$ format libsodium writes is neither produced nor read.

Verify a password

POST /password_verify takes password and the hash string. The algorithm is read from the string, so no field has to name it, and the answer carries the parameters that were read. A mismatch is a result, {"match":false}, not an error.

curl -X POST https://aisenseapi.com/services/v1/password_verify \
  -H "Content-Type: application/json" \
  -d '{"password":"correct horse battery staple","hash":"$scrypt$ln=17,r=8,p=1$XRuRTLmjykO/2l6lLaNcPQ$6+BPSBbTvew9wapsGEonhf1PCFK7MPgykUWEqd+OZI8"}'

{"match":true,"algorithm":"scrypt","params":{"log_n":17,"r":8,"p":1}}

scrypt PHC strings up to ln=17,r=8,p=1 are verified; a string that asks for more is refused with 400 and a fix, so nobody can make a verification cost more than a hash does. A hex digest sent here is refused with a pointer to /hash_verify, which is where digests are checked.

Cost, budget and the 503 you may see

One call is 100 to 230 ms of CPU on the server, 250 to 580 times a SHA-256. That is by design, and it is why these routes have a budget of their own beside the 5000 calls per day every address has: 200 password operations per IP address per day, hashing and verifying together, answered with 429 past that, and 20 000 per day for everyone, answered with 503. Both carry a Retry-After until midnight Oslo time.

The hashing runs in a process of its own, one computation at a time. While that process is busy with another caller the answer is 503 with Retry-After: 1 and "reason":"busy"; if it is down for any reason, 503 with Retry-After: 5 and "reason":"unavailable". Retry after the given seconds. Nothing else in the API is affected either way.

Why scrypt, and when

scrypt made memory the cost of a guess years before Argon2 did, and it is still sound at these parameters. OWASP lists it second, after Argon2id, for new systems; its practical home is systems that already store scrypt, and a handful of protocols that specify it. Mining with scrypt, as Litecoin does, uses tiny parameters that have nothing to do with these and proves nothing about password hashing.

Common uses

Callers reach for the free scrypt hash API endpoint in a handful of recurring situations.

Verifying existing hashes

A PHC scrypt string from a Python, Rust or Go application verifies here with its parameters reported.

Testing a login flow

Generate test strings for a fixture file without installing a library first.

Comparing profiles

Hash the same test password here and in your own code, and compare parameters and timing before settling on a profile.

Teaching

Show what N, r and p mean in a real string, and that memory is the cost that matters.

Privacy and limits

The password travels in the POST body over TLS, never in a URL, and no part of it is logged or stored: the request log keeps the status and how long the answer took. It still reaches this service in the clear inside that connection, which is why the word above is test data.

The free scrypt hash API endpoint shares the service-wide ceiling of 5000 requests per IP per day and has the password budget described above. No key, no account and no signup step stand in the way. Every route sits under the base URL https://aisenseapi.com/services/v1, and the whole catalogue is listed on Free public REST APIs.