diff --git a/ChangeLog.md b/ChangeLog.md
new file mode 100644
--- /dev/null
+++ b/ChangeLog.md
@@ -0,0 +1,5 @@
+# Changelog for `password-http-api-data`
+
+## 0.1.0.0
+
+- Split from `password-instances`.
diff --git a/LICENSE b/LICENSE
new file mode 100644
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,30 @@
+Copyright (c) Dennis Gosnell, 2019; Felix Paulusma, 2020
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * Neither the name of Dennis Gosnell, Felix Paulusma nor the names
+      of other contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/README.md b/README.md
new file mode 100644
--- /dev/null
+++ b/README.md
@@ -0,0 +1,11 @@
+# password-http-api-data
+
+[![Build Status](https://github.com/cdepillabout/password/workflows/password/badge.svg)](http://github.com/cdepillabout/password)
+[![Hackage](https://img.shields.io/hackage/v/password-http-api-data.svg)](https://hackage.haskell.org/package/password-http-api-data)
+[![Stackage LTS](http://stackage.org/package/password-http-api-data/badge/lts)](http://stackage.org/lts/package/password-http-api-data)
+[![Stackage Nightly](http://stackage.org/package/password-http-api-data/badge/nightly)](http://stackage.org/nightly/package/password-http-api-data)
+[![BSD3 license](https://img.shields.io/badge/license-BSD3-blue.svg)](./LICENSE)
+
+This package provides `http-api-data` typeclass instances for the plain-text password
+and hashed password datatypes from the
+[password](https://hackage.haskell.org/package/password) package.
diff --git a/Setup.hs b/Setup.hs
new file mode 100644
--- /dev/null
+++ b/Setup.hs
@@ -0,0 +1,33 @@
+{-# LANGUAGE CPP #-}
+{-# OPTIONS_GHC -Wall #-}
+module Main (main) where
+
+#ifndef MIN_VERSION_cabal_doctest
+#define MIN_VERSION_cabal_doctest(x,y,z) 0
+#endif
+
+#if MIN_VERSION_cabal_doctest(1,0,0)
+
+import Distribution.Extra.Doctest ( defaultMainWithDoctests )
+main :: IO ()
+main = defaultMainWithDoctests "doctests"
+
+#else
+
+#ifdef MIN_VERSION_Cabal
+-- If the macro is defined, we have new cabal-install,
+-- but for some reason we don't have cabal-doctest in package-db
+--
+-- Probably we are running cabal sdist, when otherwise using new-build
+-- workflow
+#warning You are configuring this package without cabal-doctest installed. \
+         The doctests test-suite will not work as a result. \
+         To fix this, install cabal-doctest before configuring.
+#endif
+
+import Distribution.Simple
+
+main :: IO ()
+main = defaultMain
+
+#endif
diff --git a/password-http-api-data.cabal b/password-http-api-data.cabal
new file mode 100644
--- /dev/null
+++ b/password-http-api-data.cabal
@@ -0,0 +1,81 @@
+cabal-version: 1.12
+
+name:           password-http-api-data
+version:        0.1.0.0
+category:       Security
+synopsis:       http-api-data typeclass instances for password package
+description:    A library providing typeclass instances for `http-api-data` for the types from the password package.
+homepage:       https://github.com/cdepillabout/password/tree/master/password-http-api-data#readme
+bug-reports:    https://github.com/cdepillabout/password/issues
+author:         Dennis Gosnell, Felix Paulusma
+maintainer:     cdep.illabout@gmail.com, felix.paulusma@gmail.com
+copyright:      Copyright (c) Dennis Gosnell, 2019; Felix Paulusma, 2020
+license:        BSD3
+license-file:   LICENSE
+build-type:     Custom
+extra-source-files:
+    README.md
+    ChangeLog.md
+
+source-repository head
+  type: git
+  location: https://github.com/cdepillabout/password
+
+custom-setup
+  setup-depends:
+      base           >= 4.9   && < 5
+    , Cabal                      < 4
+    , cabal-doctest  >= 1.0.6 && < 1.1
+
+library
+  hs-source-dirs:
+      src
+  exposed-modules:
+      Data.Password.HttpApiData
+--   other-modules:
+--       Paths_password_http_api_data
+  build-depends:
+      base          >= 4.9 && < 5
+    , http-api-data           < 1
+    , password-types          < 2
+  ghc-options:
+      -Wall
+  default-language:
+      Haskell2010
+
+test-suite doctests
+  type:
+      exitcode-stdio-1.0
+  hs-source-dirs:
+      test/doctest
+  main-is:
+      doctest.hs
+  ghc-options:
+      -threaded -rtsopts -with-rtsopts=-N
+  build-depends:
+      base >= 4.9 && < 5
+    , base-compat
+    , doctest
+    , password
+  default-language:
+      Haskell2010
+
+test-suite password-http-api-data-tasty
+  type:
+      exitcode-stdio-1.0
+  hs-source-dirs:
+      test/tasty
+  main-is:
+      Spec.hs
+  ghc-options:
+      -threaded -rtsopts -with-rtsopts=-N
+  build-depends:
+      base >= 4.9 && < 5
+    , password-http-api-data
+    , password-types
+    , http-api-data
+    , quickcheck-instances
+    , tasty
+    , tasty-quickcheck
+  default-language:
+      Haskell2010
diff --git a/src/Data/Password/HttpApiData.hs b/src/Data/Password/HttpApiData.hs
new file mode 100644
--- /dev/null
+++ b/src/Data/Password/HttpApiData.hs
@@ -0,0 +1,51 @@
+{-# LANGUAGE DataKinds #-}
+{-# LANGUAGE TypeOperators #-}
+{-# LANGUAGE UndecidableInstances #-}
+{-# OPTIONS_GHC -fno-warn-orphans #-}
+
+{-|
+Module      : Data.Password.HttpApiData
+Copyright   : (c) Dennis Gosnell, 2019; Felix Paulusma, 2020
+License     : BSD-style (see LICENSE file)
+Maintainer  : cdep.illabout@gmail.com
+Stability   : experimental
+Portability : POSIX
+
+This module provides `http-api-data` typeclass instances
+for 'Password'.
+
+See the "Data.Password.Types" module for more information.
+-}
+
+module Data.Password.HttpApiData () where
+
+import Data.Password.Types
+import GHC.TypeLits (TypeError, ErrorMessage(..))
+import Web.HttpApiData (FromHttpApiData(..), ToHttpApiData(..))
+
+-- $setup
+-- >>> :set -XOverloadedStrings
+-- >>> :set -XDataKinds
+--
+-- Import needed functions.
+--
+-- >>> import Data.Password.Bcrypt (Salt(..), hashPasswordWithSalt, unsafeShowPassword)
+-- >>> import Web.HttpApiData (parseUrlPiece)
+
+type ErrMsg = 'Text "Warning! Tried to convert plain-text Password to HttpApiData!"
+         :$$: 'Text "  This is likely a security leak. Please make sure whether this was intended."
+         :$$: 'Text "  If this is intended, please use 'unsafeShowPassword' before converting to HttpApiData"
+         :$$: 'Text ""
+
+-- | This instance allows a 'Password' to be created with functions like
+-- 'Web.HttpApiData.parseUrlPiece' or 'Web.HttpApiData.parseQueryParam'.
+--
+-- >>> let eitherPassword = parseUrlPiece "foobar"
+-- >>> fmap unsafeShowPassword eitherPassword
+-- Right "foobar"
+instance FromHttpApiData Password where
+  parseUrlPiece = fmap mkPassword . parseUrlPiece
+
+-- | Type error! Do not transmit plain-text 'Password's over HTTP!
+instance TypeError ErrMsg => ToHttpApiData Password where
+  toUrlPiece = error "unreachable"
diff --git a/test/doctest/doctest.hs b/test/doctest/doctest.hs
new file mode 100644
--- /dev/null
+++ b/test/doctest/doctest.hs
@@ -0,0 +1,14 @@
+module Main where
+
+import Build_doctests (flags, pkgs, module_sources)
+-- import Data.Foldable (traverse_)
+import System.Environment.Compat (unsetEnv)
+import Test.DocTest (doctest)
+
+main :: IO ()
+main = do
+  -- traverse_ putStrLn args
+  unsetEnv "GHC_ENVIRONMENT"
+  doctest args
+  where
+    args = flags ++ pkgs ++ module_sources
diff --git a/test/tasty/Spec.hs b/test/tasty/Spec.hs
new file mode 100644
--- /dev/null
+++ b/test/tasty/Spec.hs
@@ -0,0 +1,20 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+import Test.Tasty (TestTree, defaultMain, testGroup)
+import Test.Tasty.QuickCheck (testProperty, (===))
+import Test.QuickCheck.Instances ()
+import Web.HttpApiData (FromHttpApiData (..))
+
+import Data.Password.Types (unsafeShowPassword)
+import Data.Password.HttpApiData ()
+
+
+main :: IO ()
+main = defaultMain $ testGroup "Password Instances"
+  [ fromHttpApiDataTest
+  ]
+
+fromHttpApiDataTest :: TestTree
+fromHttpApiDataTest =
+    testProperty "Password (FromHttpApiData)" $ \pw ->
+        (Right pw) === (unsafeShowPassword <$> parseUrlPiece pw)