Needs to have the actual password obscured, e.g. with asterisks.

In fact, also the length should be obscured, show nothing, as is the way in Unix password prompts!

An api that's $1/request unless you have a prime number of requests, then it's free.

please try playing the game, it's not about this :)