Forem: Ruan Muller

Day 2 of my 21-day API challenge, built a Password Strength & Security Scorer API

Ruan Muller — Sun, 05 Apr 2026 11:23:59 +0000

Day 2 of my 21-day API challenge is done.

Yesterday I built an Invoice & Receipt Parser API. Today I built a Password Strength & Security Scorer API — a complete password security toolkit that any developer can drop into their signup flow in minutes.

If you missed Day 1, catch up here: https://dev.to/ruanmuller04

The Problem

Every app with a login form needs password validation. Most developers end up writing the same basic checks:

// The lazy version every dev writes at 2am
if (password.length < 8) return "too short";
if (!/[A-Z]/.test(password)) return "needs uppercase";

It works. But it misses so much — common breached passwords, keyboard patterns, crack time estimates, entropy calculations. Building all of that properly takes days.

So I built an API that does it properly in one call.

What I Built

The Password Strength & Security Scorer API — send it a password, get back a full security report.

Input:

{
  "password": "password123"
}

Output:

{
  "success": true,
  "data": {
    "score": 0,
    "grade": "F",
    "strength": "very weak",
    "entropy_bits": 58.5,
    "crack_time": {
      "display": "5 months",
      "online_attack": "58 years",
      "offline_attack": "5 months"
    },
    "patterns": {
      "is_common_password": true,
      "has_sequential_nums": true,
      "ends_with_number": true
    },
    "feedback": [
      "This is one of the most common passwords",
      "Contains sequential numbers (e.g. 123)",
      "Ends with a number — very predictable"
    ],
    "suggestions": [
      "Choose a completely different password",
      "Add uppercase letters (A-Z)",
      "Add symbols (!@#$%^&*)"
    ]
  }
}

And for a strong password:

{
  "password": "K#9mP$vL2@nQ8xR!"
}

{
  "score": 75,
  "grade": "B",
  "strength": "strong",
  "crack_time": { "display": "2 million years" }
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/analyze`	Full password analysis
POST	`/analyze/batch`	Analyze up to 20 passwords at once
POST	`/check/breach`	Check against 500+ breached passwords
POST	`/generate`	Generate strong passwords
POST	`/compare`	Compare two passwords side by side

The /generate endpoint is my favourite — it returns strong passwords with their scores so you can show users exactly how secure the suggested password is.

How the Scoring Works

The score (0-100) is calculated from four components:

1. Length (0-30 points)

6 chars  →  5 pts
8 chars  → 10 pts
12 chars → 20 pts
16 chars → 25 pts
20+ chars → 30 pts

2. Character sets (0-28 points)
Each charset adds 7 points:

Lowercase letters
Uppercase letters
Numbers
Symbols

3. Unique character ratio (0-15 points)
Rewards passwords where characters don't repeat.

4. Entropy (0-15 points)
Calculated as: length × log2(pool_size)

Penalties applied for:

Common passwords: -40 points
Keyboard walks (qwerty, asdfgh): -20 points
Repeated characters (aaa): -10 points
Sequential numbers (123): -10 points
All numbers or all letters: -15 points

Crack Time Estimation

This was the most interesting part to build. The formula:

function estimateCrackTime(password, charsets) {
  let poolSize = 0;
  if (charsets.has_lowercase) poolSize += 26;
  if (charsets.has_uppercase) poolSize += 26;
  if (charsets.has_numbers)   poolSize += 10;
  if (charsets.has_symbols)   poolSize += 32;

  const combinations = Math.pow(poolSize, password.length);

  // Modern GPU: 10 billion guesses/second
  const seconds = combinations / 1e10;

  return formatTime(seconds);
}

The difference between online and offline attacks matters:

Online attack — 10 million/sec (limited by server rate limiting)
Offline attack — 10 billion/sec (attacker has the hash file)

password123 cracks in 5 months offline but 58 years online. That's why rate limiting matters even if your hashing is weak.

Breach Detection

The API checks against the 500 most common breached passwords — the ones that appear in every data breach dump.

const COMMON_PASSWORDS = new Set([
  "password", "123456", "qwerty", "abc123", "monkey",
  "letmein", "trustno1", "dragon", "baseball", "iloveyou",
  // ... 490 more
]);

function checkBreach(password) {
  const is_compromised = COMMON_PASSWORDS.has(password.toLowerCase());
  return {
    is_compromised,
    risk_level: is_compromised ? "critical" : "low",
  };
}

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero AI. The whole thing costs less than $5/month to run.

Score Guide

Score	Grade	Strength
80-100	A	Very Strong
60-79	B	Strong
40-59	C	Moderate
20-39	D	Weak
0-19	F	Very Weak

Recommended minimum for most apps: Grade B (60+)
Recommended for financial apps: Grade A (80+)

Try It

Live on RapidAPI — search Password Strength Security Scorer or find me at rapidapi.com/user/ruanmul04.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 3 tomorrow — VAT Number Validator API.

Every e-commerce platform selling to Europe needs VAT validation. There are almost no good free options on RapidAPI. That's the gap I'm filling tomorrow.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

I Built an Invoice Parser API in One Day

Ruan Muller — Sat, 04 Apr 2026 16:02:23 +0000

I'm a developer from South Africa, currently studying for my Bachelor of Accounting. Today I started a challenge: build and publish a new API every day for 21 days straight.

Day 1 is done. Here's exactly what I built, how it works, and how you can use it.

The Problem:

Every accounting app, expense tracker, and bookkeeping tool has the same pain point, invoices come in as PDFs, images, or plain text, and somebody has to pull the structured data out of them.

Vendor name. Invoice number. Line items. Tax. Total. Due date.

It's repetitive, error-prone work. And every developer building a finance tool ends up writing the same messy regex logic to solve it.

So I built an API that does it for them.

What I Built:

The Invoice & Receipt Parser API — send it raw invoice text, get back clean structured JSON.

Input:

{
  "text": "Acme Corp\nInvoice No: INV-2024-0042\nDate: 15/03/2024\nDue: 15/04/2024\n\nWeb Design Services  2  $1500.00  $3000.00\nSEO Optimization     1   $800.00   $800.00\n\nSubtotal: $3800.00\nVAT 15%:   $570.00\nTotal Due: $4370.00"
}

Output:

{
  "success": true,
  "data": {
    "document_type": "invoice",
    "vendor_name": "Acme Corp",
    "invoice_number": "INV-2024-0042",
    "dates": {
      "invoice_date": "15/03/2024",
      "due_date": "15/04/2024"
    },
    "currency": "USD",
    "totals": {
      "subtotal": 3800,
      "tax_rate": 15,
      "tax_amount": 570,
      "discount": null,
      "shipping": null,
      "total": 4370
    },
    "line_items": [
      {
        "description": "Web Design Services",
        "quantity": 2,
        "unit_price": 1500,
        "amount": 3000
      },
      {
        "description": "SEO Optimization",
        "quantity": 1,
        "unit_price": 800,
        "amount": 800
      }
    ],
    "confidence": {
      "score": 100,
      "level": "high"
    }
  }
}

No AI costs. No third-party dependencies. Pure Node.js, which means near-zero running costs and sub-100ms response times.

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Check API is online
POST	`/parse`	Full extraction — all fields
POST	`/parse/totals`	Financial totals only
POST	`/parse/line-items`	Line items only
POST	`/parse/vendor`	Vendor details only
POST	`/validate`	Completeness score + missing fields

The lightweight endpoints are useful for high-volume pipelines where you only need one piece of data and don't want to pay for a full parse every time.

How It Works

The core logic is a chain of regex-based extractors, each one focused on one thing.

function fullParse(text) {
  return {
    document_type:  detectDocType(text),
    vendor_name:    extractVendor(text),
    invoice_number: extractInvoiceNumber(text),
    dates:          extractDates(text),
    currency:       extractCurrency(text),
    totals:         extractTotals(text),
    line_items:     extractLineItems(text),
    payment_info:   extractPaymentInfo(text),
    contact:        extractContact(text),
    confidence:     calculateConfidence(data),
  };
}

Currency detection checks for 25+ currency codes and symbols:

const CURRENCY_CODES = ["USD","EUR","GBP","ZAR","INR",...];

function extractCurrency(text) {
  for (const code of CURRENCY_CODES) {
    if (new RegExp(`\\b${code}\\b`).test(text)) return code;
  }
  if (text.includes("$")) return "USD";
}

One bug I caught during testing, the tax amount extractor was matching 15 from VAT 15% instead of the actual amount 570.00. The fix was requiring a decimal point in the match:

// BROKEN — matches "15" from "VAT 15%"
/(?:vat|tax)[\s:$]*([0-9,. ]+)/i

// FIXED — requires decimal format, skips percentages
/(?:vat|tax)[\s:%\d]*?[\s:$£€]+([0-9,]+\.[0-9]{2})/i

Always test with real messy invoice text before shipping.

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero AI costs. The whole thing costs less than $5/month to run.

Pricing on RapidAPI

Plan	Price	Requests
Free	$0	10/month
Basic	$9.99/mo	500/month
Pro	$29.99/mo	5,000/month

What I Extracted From This Build

My accounting background actually helped here. I knew exactly what fields matter on a real invoice, payment terms, VAT rates, SWIFT codes, IBAN numbers. That domain knowledge made the extractor more accurate than a generic solution would be.

It's a reminder that your background, whatever it is, is an advantage when building in the right niche.

Try It

The API is live on RapidAPI, search for Invoice Receipt Parser or find my profile at [https://rapidapi.com/user/ruanmul04].

Free tier gives you 10 requests/month to test it with your own invoices.

What's Next

Day 2 tomorrow — Password Strength & Security Scorer API.

If you want to follow the 21-day build challenge, follow me here on dev.to. I'll be posting every day with the full breakdown of what I built, why, and how.

Drop a comment if you're building APIs too, always keen to connect with other developers doing the same thing. 🇿🇦

Built in South Africa. Sold globally.