NINicoJuicy·Nov 27, 2019Submission
Dropbox/Zxcvbn: Low-Budget Password Strength Estimation
4 points · Open discussiondropbox
zxcvbn
CoffeeScript2012–2024
dropbox / zxcvbn
zxcvbn
Low-Budget Password Strength Estimation
58Distinct people
62Mentions
0Explicit recommenders
16.1KGitHub stars
What to know before exploring
What it is
Low-Budget Password Strength Estimation
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:01:12 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year62 dated mentions
Observed mentions: 2012-04-14 18:08:57 UTC to 2024-10-18 18:38:01 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 0 | 3 |
What Hacker News says
6 sourcesWe already have zxcvbn
https://github.com/dropbox/zxcvbn
In In Its First Funding in 14 Years, 1Password Raises $200M Series Aobligatory thread naming good open-source password entropy checkers. I'll start.
zxcvbn: https://github.com/dropbox/zxcvbn
In Sites with dumb password rulesThis is a good summary of the NIST recommendations [1, Sec 5.1] found in [2].
Dropbox released a library [3] that's easy enough to configure to add your own black list (e.g., your company name, your public wifi password, etc.)
Finally, my recommendation is to enforce same password between laptop and web tools, and use SSO wherever possible.
Password requirements:
- 8-char minimum and 64-char maximum length
- The ability to use all special characters but no special requirement to use them
- Restrict sequential and repetitive characters (e.g. 12345 or aaaaaa)
- Restrict context specific passwords (e.g. the name of the site, etc.)
- Restrict commonly used passwords (e.g. p@ssw0rd, etc.)
- Restrict passwords obtained from previous breach corpuses
[1] https://pages.nist.gov/800-63-3/sp800-63b.html
[2] https://spycloud.com/new-nist-guidelines/
Read the rest
Or, alternatively, switching to the haveibeenpwned API[1] or zxcvbn[2].
[1]: https://haveibeenpwned.com/API/v2
[2]: https://github.com/dropbox/zxcvbn
In Strong_password Rubygem hijackedZxcvbn: Password Strength Estimator
1 points · Open discussion