tai-password-strength

Password Strength Tester
========================

Password Strength is a library that calculates the relative strength of a password. This is accomplished by using several techniques. Primarily this relies on letter trigraphs, which check each set of 3 characters in a given password. More information on the trigraph calculations is available. This also calculates the entropy bits based on Claude Shannon's technique on determining the number of bits required to represent a set of characters and multiplying it by the length of the password. There is also a check to see if a password is contained in a list of common passwords.

There is a wonderful demo page where you can test out the technology yourself.

[![npm version][npm-badge]][npm-link]
[![Build Status][travis-badge]][travis-link]
[![Dependencies][dependencies-badge]][dependencies-link]
[![Dev Dependencies][devdependencies-badge]][devdependencies-link]

Usage
-----

The Password Strength library is wrapped with [fid-umd], and is usable in a variety of systems. When you use the .check() method for the password "abcd1234", the results may look like what you see below. Comments are added to explain the fields.

{
charsetSize: 36, // Explained better below
commonPassword: true, // If true, don't use this password!
nistEntropyBits: 18, // NIST 800-63, probably not a good measurement
passwordLength: 8, // Same as string.length
shannonEntropyBits: 24, // Claude Shannon's method
strengthCode: 'WEAK', // Our ranking of the password's strength
trigraphEntropyBits: 39.71755017780513, // Based on trigraphs
charsets: {
number: true, // Contains 0-9
lower: true, // Contains a-z
upper: false, // Contains A-Z
punctuation: false, // Contains common sentence punctuation
symbol: false, // Contains mathematical symbols
other: '' // Unicode and uncaught characters
}
}

The charset size is the sum of the lengths of the different charsets that the password uses. The higher this number, the harder it is to brute force attack. That's precisely why password policies often say "must contain one lowercase letter, one uppercase letter, one number and a symbol".

The strength code is based on the trigraph entropy bits when they are available and will fall back to the Shannon entropy bits. It's one of five values: VERY_WEAK, WEAK, REASONABLE, STRONG, and VERY_STRONG. The NIST scores are based on NIST Special Publication 800-63, but this is considered to not provide an accurate measurement of entropy and is included for completeness and comparison to the other algorithms.

Trigraph entropy bits is discussed more here.

The charsets is mostly an object that has boolean values, except the other property. That one is a catch-all string of the letters that were not caught and tallied into another one of the charset lists. The list of characters in other is deduplicated.

$3

Include lib/password-strength.js in your project.