_________________________________________________/\/\___________________ _/\/\/\/\/\__/\/\__/\/\____/\/\/\/\__/\/\__/\/\__/\/\________/\/\/\/\___ _____/\/\______/\/\/\____/\/\________/\/\__/\/\__/\/\/\/\____/\/\__/\/\_ ___/\/\________/\/\/\____/\/\__________/\/\/\____/\/\__/\/\__/\/\__/\/\_ _/\/\/\/\/\__/\/\__/\/\____/\/\/\/\______/\______/\/\/\/\____/\/\__/\/\_ ________________________________________________________________________
zxcvbnattempts to give sound password advice through pattern matching and conservative entropy calculations. It finds 10k common passwords, common American names and surnames, common English words, and common patterns like dates, repeats (aaa), sequences (abcd), and QWERTY patterns.
For full motivation, see:
is the best way to add
zxcvbnto your site. Host
zxcvbn-async.jssomewhere on your web server, and make the hardcoded path inside
zxcvbn.js. A relative path works well.
zxcvbn-async.jsis a tiny 350 bytes. On
window.load, after your page loads and renders, it'll fetch
zxcvbn.js, which is more like 700k (330k gzipped), most of which is a series of dictionaries.
I haven't found 700k to be too large -- especially because a password isn't the first thing a user typically enters on a registration form.
zxcvbn.jscan also be included directly:
But this isn't recommended, as the 700k download will block your initial page load.
zxcvbnadds a single function to the global namespace:
It takes one required argument, a password, and returns a result object. The result includes a few properties:
Data lives in the first two scripts. These get produced by:
init.coffeemake up the rest of the library.
init.jsneeds to come last, otherwise script order doesn't matter.
I recommend setting up coffee-mode in emacs, or whatever equivalent, so that CoffeeScript compiles to js on save. Otherwise you'll need to repetitively run
AcknowledgmentsDropbox, thank you in so many ways, but in particular, for supporting independent projects both inside and outside of hackweek.
Many thanks to Mark Burnett for releasing his 10k top passwords list:
and for his 2006 book, "Perfect Passwords: Selection, Protection, Authentication"
Huge thanks to Wiktionary contributors for building a frequency list of English as used in television and movies: http://en.wiktionary.org/wiki/Wiktionary:Frequencylists
Last but not least, big thanks to xkcd :) https://xkcd.com/936/