password-strength

password-strength

A password strength calculator based on Dropbox's password strength estimator zxcvbn.

Also checks with haveibeenpwned API if a given password has been compromised.

Build

make
make install

Usage

  -password string
    	a password
  -word string
    	used word
  -pwned
    	check with haveibeenpwned API if password has been seen before

Examples

password-strength -password "Tr0ub4dor&3," -word troubador

Password:		Tr0ub4dor&3,
Password strength:	1/4
Guesses Log10:		5.041393

Guess times
100 / h:		1 months 	(throttled online attack)
10  / s:		3 hours  	(unthrottled online attack)
10k / s:		11 seconds	(offline attack, slow hash, many cores)
10b / s:		< 1 second	(offline attack, slow hash, many cores)

passphrase-entropy -password "correcthorsebatterystaple" -word "correct" -word "horse" -word "battery" -word "staple"

Password:		correcthorsebatterystaple
Password strength:	4/4
Guesses Log10:		12.008345

Guess times
100 / h:		Centuries	(throttled online attack)
10  / s:		Centuries	(unthrottled online attack)
10k / s:		3 years  	(offline attack, slow hash, many cores)
10b / s:		2 minutes	(offline attack, slow hash, many cores)

Acknowledgements

password-strength is based on trustelem's go implementation of Dropbox's password strength estimator zxcvbn.

Also checks with haveibeenpwned API if a given password has been compromised with a forked version of sinduvi87's haveibeenpwned.