# New Password — anew.pw

> Generate a password on the user's device, or explicitly request a value in your tool. No account required.

## Give the user a link (preferred)
- [20-character password](https://anew.pw/char/20/strong): choose 12–64 characters.
- [7-word passphrase](https://anew.pw/words/7): choose 6–8 independent EFF words.
- [32-byte secret](https://anew.pw/?mode=secret&bytes=32&format=base64url): sizes 16/32/64; formats base64url/base64/hex.
- [Site rules](https://anew.pw/#rules=Maximum%2016%20characters%2C%20no%20symbols): bounded supported rules in the fragment; unsupported rules fail closed. Do not combine with Secret.

Send the matching link. The user opens it and copies locally. Links contain settings only: never put passwords, keys or personal information in them. Do not ask the user to paste the generated value into chat.

## Return a password to an agent (only when requested)
Server release required; public endpoint availability is not yet verified.
- GET https://anew.pw/now — plaintext password plus newline.
- GET https://anew.pw/now?length=24&format=json — password, length, generated=server.
- Options: length 12–64 (default 20), symbols true/false (default true), readable true/false (default true).
- MCP: POST https://anew.pw/mcp, Streamable HTTP JSON. Client authorization to connect is required. Use tools/list for schemas: create_password_link (length OR rules), generate_password (length, symbols, readable).

Remote generation exposes the value to the calling agent and its history. Responses use no-store; application code does not log or persist values. Caller and hosting policies still apply. No protected injection, vault, password reset, service setup or asymmetric key-pair generation.

## More
- [Human-readable agent guide](https://anew.pw/agents)
- [Methods and privacy](https://anew.pw/about.html)
- [Markdown guide](https://anew.pw/agents.md): also request / or /agents with Accept: text/markdown. Normal browser requests receive HTML. Discovery depends on the client; no automatic connection is implied.

Remote API availability: /now and MCP share a site-wide budget of 300 requests per minute. HTTP 429 or 503 includes Retry-After: 60. Wait before retrying; do not retry in a loop. Browser-local generation and settings links remain available. This is a shared safety budget, not a per-user quota or a DDoS guarantee.