BRbradbeattie·Dec 6, 2013
https://github.com/lowe/zxcvbn does a pretty good job of the same thing.
In Telepathwords: A New Password Strength Estimatordropbox
zxcvbn
CoffeeScript2012–2024
dropbox / zxcvbn
zxcvbn
Low-Budget Password Strength Estimation
58Distinct people
62Mentions
0Explicit recommenders
16.1KGitHub stars
What to know before exploring
What it is
Low-Budget Password Strength Estimation
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 11:19:25 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year62 dated mentions
Observed mentions: 2012-04-14 18:08:57 UTC to 2024-10-18 18:38:01 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 0 | 3 |
What Hacker News says
7 sourcesThis wasn't about password strength calculation - this is really a question to the maintainers of https://github.com/lowe/zxcvbn.
In Simple solution to the password reuse problemzxcvbn (https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht..., https://github.com/lowe/zxcvbn) basically has this aim. It might be missing some patterns exploited in attacks, but it’s extensible enough that they shouldn’t be too hard to add.
In How crackers ransack passwords like “qeadzcwrsfxv1331”Regarding password strength checkers, see also https://github.com/lowe/zxcvbn
In Why Intel’s “How Strong is Your Password?” site can’t be trustedThat's true. What I should have said was that we want to make the entropy easy to measure. If I flip through random passwords until I find one that's easy to remember, I have no idea how much entropy I've lost. But the mad-libs method should let us know exactly what our effective key length is, and allow us to make up for it with longer phrases if needed.
Edit: Another technique that I find useful is to place the four words into a more memorable sentence. For example, if I pull "frequently scared earth understanding" from passphra.se, I might have trouble remembering that raw sequence of words. But if I put it into a sentence like "I am frequently scared, but the Earth is understanding.", then I have a much more evocative sentence that I'm likely to remember. I usually will just use that whole sentence, punctuation and all, because hey, e
Read the rest
xtra entropy. Dropbox's zxcvbn tool[1] estimates that pass phrase at nearly 128 bits of entropy.
[1] https://github.com/lowe/zxcvbn
Advanced password strength library in Javascript
1 points · Open discussionThanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful:
https://github.com/lowe/zxcvbn
zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you!
zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calculations. It finds 10k common passwords, common American names and surnames, common English words, and common patterns like dates, repeats (aaa), sequences (abcd), and QWERTY patterns.
Sample results (including Tr0ub4dour&3 and correcthorsebatterystaple) and a demo can be found here:
http://dl.dropbox.com/u/209/zxcvbn/test/index.html
In Evernote hacked