I need to use the library in an internationalized website, which means that I need the feedback messages in other languages. I added the optional third parameter options, in where you can pass a feedback_messages Array-like object with custom messages.

Do you guys think it worth adding this to the library?

Example usages:

Redifining all the messages

zxcvbn('example', ['paul'], {feedback_messages: ['Utilice varias palabras, evite frases comunes', ...]});

Changing an specific message

zxcvbn('example', ['paul'], {feedback_messages: {9: 'Sequences are easy to guess'}});

WordPress has an issue where if a long password (500+ characters) is checked for password strength, the browser becomes unresponsive for many seconds or minutes: See issue #31772 for the details.

Possible solutions

1. Use Web Workers to do the strength checking
   • Would this be a welcome contribution?
2. Enhance axcvbn to stop checking strength once a specified threshold of entropy is reached.
   • What would the default threshold be?
3. Only use zxcvbn if the password is more than 32 characters long
   • The problem with this is that weak passwords can be longer than 32 characters. E.g. 33 zeroes: 000000000000000000000000000000000
4. Only use zxcvbn on the first 32 characters
   • Would this make zxcvbn less effective?
5. Improve the performance of the strength-checking for longer passwords
   • Is this even possible without significantly impacting its accuracy?

How much would I lose running this library without the dictionary part? My concern is about file size since 300kb download is unacceptable in [my] mobile scenario.. What dropbox does about that? Thanks for such library, anyhow it is awesome.

Would suggest a preliminary cleanup of the project structure...

data/          - data directory
data-scripts/  - python scripts to load/parse data
dist/          - folder for target/compiled js
src/           - coffeescript & javascript source files
tests/         - unit tests (mocha?)
bower.json     - bower package info
package.json   - npm/node package information

package.json can reference src/(index.js) as the primary file. npm scripts can be added to package.json for build, and/or use something like gulp.

Given that npm is already used for the installation of coffee-script and the nature of this package, it may be worthwhile to use uglify-js over closure compiler. It may not be quite as tight, but would reduce the need for external tooling (beyond node/npm) for this.

Converting the scripts to use CommonJS/node syntax could be used in combination with Browserify for the build, enabling a global and amd target in the dist directory from the same source.

I'd be happy to take this on, creating a fork and PR for the changes if there would be interest for including such changes/updates.

zxcvbn assumes that passwords are hashed with bcrypt, scrypt or PBKDF2. This is fine when you know exactly what hashing algorithm is used. Sadly this isn't always the case and it should be stated more clearly in the project documentation.

The assumed time per guess(with strong hash) is 1/10 seconds and with 100 cores that makes 1/10000 seconds. With MD5, SHA256 or SHA512, the situation is different. For example with Oclhashcat, it takes just 1/1952000000 seconds to calculate single SHA512 hash(using 8 GPUs). See oclHashcat performance table.

For example with skjiqonjhrp, zxcvbn returns 3 years as crack time. If it was hashed with SHA512, the crack time would be about 320 seconds. I calculated it with entropy returned by zxcvbn and using the same formula as in your blog post: 0.5 * 2^40.188 * 1/1952000000. The difference is huge.

If people would use this as a general "how good is my password" meter, it would give overly optimistic results since there are countless of services out there using MD5/SHA256/SHA512.

The original zxcvbn-php library scores didn't match the JS libary, making it a pain to use both libraries together. It was forked to mkopinsky/zxcvbn-php and the work was done to bring it inline with the JS library. @bjeavons says his library was inspired by the original, and wasn't to be an exact match (https://github.com/bjeavons/zxcvbn-php/issues/15#issuecomment-377952148)

While listing 2 PHP libraries may be a little confusing, it would be beneficial for those looking for an exact matching library to be able to find it from this readme.

The "try zxcvbn internatively" link in README, Usage section is broken now. https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html seems returned a 404.

I think this demo is useful and helps people understand zxcvbn more easier.

The Ars Technica article http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/2/ said that they quickly bruteforced all passwords of 6 or less, plus the all-upper or all-lower passwords of length 7 or 8 in just 41 seconds.
Yet the 'crack time (display):' for an all caps 7 char password is 5 years. I suspect more GPU power has made cracking faster.

I registered zxcvbn in the bower registry pointing to git://github.com/lowe/zxcvbn.git. It will work as is, but would be more "correct" if you have this bower.json file in your repo, and tag your commits with semver version numbers.

Hi.

When I call zxcvbn('Tr0ub4dour&3') from my Javascript code the returned value is not the object described in the "Usage" section of the main GitHub page, i.e.:

result.entropy            # bits

result.crack_time         # estimation of actual crack time, in seconds.

result.crack_time_display # same crack time, as a friendlier string:
                          # "instant", "6 minutes", "centuries", etc.

result.score              # [0,1,2,3,4] if crack time is less than
                          # [10**2, 10**4, 10**6, 10**8, Infinity].
                          # (useful for implementing a strength bar.)

result.match_sequence     # the list of patterns that zxcvbn based the
                          # entropy calculation on.

result.calc_time          # how long it took zxcvbn to calculate an answer,
                          # in milliseconds.

but instead is the following object:

calc_time: 3
guesses: 594963824
guesses_log10: 8.7744905598213
password: "Tr0ub4dour&3"
sequence: Array[2]
sequence_length_multiplier_log10: 0.30102999566398114
sequence_product_log10: 8.473460564157321

I cannot seem to get the correct return value.

Any help would be appreciated.

Many thanks.

Previously the dictionary was appended to with each function call, so user_input from previous calls would persist and build up, affecting the scores of passwords that it was not intended to. Because the user input can change on each call, the dictionary and corresponding matcher function need to be reset and built with the current user input on each call.

https://lowe.github.io/tryzxcvbn/ has a dead link, seemingly.

"Dropbox blog link" goes to http://tech.dropbox.com/?p=165. This seems to be a friendly 404 page.

I believe the correct link is https://dropbox.tech/security/zxcvbn-realistic-password-strength-estimation

Cheers and thank you for your demo site!

Hi, we just wanted to say thanks for putting this library together. It is intuitive and easy to use. We used the library to display password strength in 2 of our latest tools:

• Password Generator
• Password Strength Tester

Thanks again. -- The AwesomeTools.org team 😊

Hi.

I'm using zxcvbn libraries on back-end and front-end of an app. For front-end: https://github.com/zxcvbn-ts/zxcvbn For back-end: https://github.com/nulab/zxcvbn4j

The password strength score returned for the same password string, "Tiger@0177" is different for both the libraries. For TS version, it returns 3 (Strong) while for Java version, it returns 2 (Weak), which is giving a very bad UX for my users.

Can you suggest something why is this happening and is there a way to fix this issue? TIA.

Currently it is set to

REGEXEN = {
  recent_year: /19\d\d|200\d|201\d/g
};

it looks like it needs to be updated to include 202X

REGEXEN = {
  recent_year: /19\d\d|20[012]\d/g
};

Although that will only last a bit over 7 more years that should be enough time to figure out an even better regex update :)