Skip to content

JavaScript port of passwdqc. A password/passphrase strength checking and policy enforcement toolset.

License

Notifications You must be signed in to change notification settings

odin-public/passwdqc-js

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

31 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Passwdqc-js

About

The passwdqc is the brilliant password quality checker library made by Openwall. Passwdqc-js is a JavaScript port of passwdqc, made by Parallels. Passwdqc-js supports AMD and NodeJS/CommonJS module format. So it runs on both client and server.

Demo page (Limited functionality)

http://doc.apsstandard.org/7.2/apsfiddle/?file=7.2/_static/examples/password/calcStrength.html

Compatibilty with Passwdqc

Passwdqc-js was tested for compatibility with original passwdqc. We used following password databases in order to guarantee that both accept nearly the same subset of passwords:

  • 14M unique RockYou passwords from 2009 leak (99.99% match with passwdqc)
  • 10K random 10-character symbolic passwords (100% match with passwdqc)
  • 10K random pass phrases, generated by passwdqc/pwqgen (100% match with passwdqc)

Usage

Use passwdqc.check(newpass, [oldpass], [login], [gecos], [params]) function to check password quality.

Parameters

  • newpass: password to check
  • oldpass: old password to check if new password is based on it
  • login: user's login name to check that password is not based on it
  • gecos: any other personal information to check
  • params: custom parameters for passwdqc algorithm, see

Return value

  • Empty string if password is considered good;
  • The reason why password is considered weak, otherwise.

Examples

NodeJS

var passwdqc = require('passwdqc');

var rv = passwdqc.check(password, old_password);

if (!rv) {
	// Password is of good quality
	// ...
} else {
	// The "rv" now contains reason why password considered weak
}

Client-Side

// Declare security policy
var lowParams	 = { min: [6,  6,  6, 6, 6], max: 40, passphrase_words: 3, match_length: 4, similar_deny: 1, random_bits: 47, flags: 3, retry: 3 },
	mediumParams = { min: [8,  8,  8, 7, 6], max: 40, passphrase_words: 3, match_length: 4, similar_deny: 1, random_bits: 47, flags: 3, retry: 3 };

// Checking value
function check(val){
    if(val.length == 0) return 0;
    if(!passwdqc_check(val)) return 4;
    if(!passwdqc_check(val, undefined, undefined, undefined, mediumParams)) return 3;
    if(!passwdqc_check(val, undefined, undefined, undefined, lowParams)) return 2;
    return 1;
}

Live full example

Distribution

NPM

npm install passwdqc

Bower More info about Bower

bower install passwdqc

TODO

  • More examples
  • Random password/passphrase generator

About

JavaScript port of passwdqc. A password/passphrase strength checking and policy enforcement toolset.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published