JOjosefresco·Dec 6, 2018
Also this, which references the same comic: https://github.com/dropbox/zxcvbn
In Passwords: Using 3 Random Words Is a Really Bad Idea (2017)dropbox
zxcvbn
CoffeeScript2012–2024
dropbox / zxcvbn
zxcvbn
Low-Budget Password Strength Estimation
58Distinct people
62Mentions
0Explicit recommenders
16.1KGitHub stars
What to know before exploring
What it is
Low-Budget Password Strength Estimation
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:59:58 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year62 dated mentions
Observed mentions: 2012-04-14 18:08:57 UTC to 2024-10-18 18:38:01 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 0 | 3 |
What Hacker News says
8 sourcesI like this entropy based password strength checker:
https://github.com/dropbox/zxcvbn
Here you can see that it realizes that all your passwords are weak: https://lowe.github.io/tryzxcvbn/ (it says: cracked in minutes, or seconds, in an offline attack)
And it does this without requiring uppercase or symbols or numbers. It even understands that passwords like "qwerty" are trivially cracked – it looks at how far the keyboard keys are from each other. Among lots of other things.
In 86% of CrashCrate subscribers used passwords already leaked in other breachesDropbox's zxcvbn[1] seems to do a good job of this along with detecting sequences and keyboard patterns.
[1] https://github.com/dropbox/zxcvbn
In Show HN: How Secure Is My PasswordDropbox's zxcvbn password-strength estimator already incorporates a list of 250k+ common passwords and words. No need to make a separate blacklist check unless you want to check more than what zxcvbn already does. (and you could enforce it more strongly on the server instead of locally in JS like zxcvbn)
For reference, these are the passwords and common words zxcvbn already checks against: https://github.com/dropbox/zxcvbn/tree/master/data
And with zxcvbn it'll still flag a password as low entropy/low security if the password it's checking is just a simple modification of something on the common password list.
In "Pwned Passwords" V2 With Half a Billion PasswordsThe UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt.
Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before.
I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead, he doubled down:
https://twitter.com/TychoTithonus/status/966400790221930496
Please don't use the entire list for blacklisting unless you actively also guide the user in how to generate a random passphrase (if a human must remember it) or a random password (if it will be stored in a password manager).
Instead:
1. Use a high-level password-strength assessment widget like zxcvbn:
https://github.com/dropbox/zxcvbn
2. Configure
Read the rest
a blacklist with, say, 10K or 20K of the most common passwords.
3. Hash passwords with bcrypt cost 12 (adjusted to your platform's hashrate capabilities), scrypt, or the appropriate method from the Argon2 family.
But for all that is holy, please don't use Troy's entire corpus - or even the first million - as a blacklist. To quote the old NANOG saw, I encourage all of my competitors to use it. ;)
Edit: And since Troy's API at this writing does not support only querying the top X passwords, there's no way to use the API while avoiding the UX nightmare. So if you want to use this data in a professional manner, but don't want to download the entire corpus, here are the first 20K from his list (of which I've only personally cracked 19965 so far, interestingly; gist will be updated once I get all 20K):
https://gist.github.com/roycewilliams/281ce539915a947a23db17...
Edit 2: Preliminary results indicate that this data may be dirty. The 273rd most common password, according to Troy, is '$HEX'. This is almost certainly an import/conversion artifact, since the '$HEX' prefix is how most cracking suites escape non-ASCII or passwords that contain colons. I expect that there will be more artifacts. Use the data with caution.
It makes sense as an approach – Dropbox open-sourced a library along these lines, called zxcvbn: https://github.com/dropbox/zxcvbn
In How Long Is Long Enough? Minimum Password Lengths by the World's Top SitesSee also: https://github.com/dropbox/zxcvbn
(I'm not connected or affiliated with Dropbox or this project.)
In How Long Is Long Enough? Minimum Password Lengths by the World's Top SitesThis is excellent advice and zxcvbn [1] looks awesome.
[1] https://github.com/dropbox/zxcvbn
In Safari Password Generation