password-strength-lite

Lightweight, dependency-free password strength estimator. Estimates entropy from character-class pool + length, applies pattern penalties (repeats, sequences, keyboard runs, years, leetspeak substitutions), checks against a built-in common-password list, and returns a 0-4 score with reasons, suggestions, and crack-time estimates at four documented guess rates.

This is smaller and less accurate than zxcvbn — use zxcvbn for high-stakes flows (account signup for a bank, password managers, anything where an underestimate has real consequences). This library is meant for lightweight UI feedback (a strength meter, inline suggestions) where a "good enough" heuristic beats no feedback at all, at a fraction of zxcvbn's bundle size and with zero runtime dependencies.

Install

npm install password-strength-lite

Usage

import { estimateStrength } from "password-strength-lite";

const result = estimateStrength("password123");
// {
//   score: 0,
//   entropyBits: 0,
//   reasons: [
//     'matches a common password (with or without common substitutions)',
//     'contains a predictable sequence (e.g. "abc", "123")',
//     'contains a keyboard-adjacent pattern (e.g. "qwerty", "asdf")'
//   ],
//   suggestions: [...],
//   patterns: [...],
//   crackTimes: [
//     { scenario: 'onlineThrottled', guessesPerSecond: 0.0278, seconds: 36, display: '36 seconds' },
//     { scenario: 'onlineUnthrottled', guessesPerSecond: 10, seconds: 0.1, display: '0.1 seconds' },
//     { scenario: 'offlineSlowHash', guessesPerSecond: 10000, seconds: 0, display: '0 seconds' },
//     { scenario: 'offlineFastHash', guessesPerSecond: 1e10, seconds: 0, display: '0 seconds' }
//   ]
// }

Run npm run build && npm run demo to see the full demo, including a diceware-style passphrase scoring 4/4.

API

estimateStrength(password: string): StrengthResult

Returns:

• score: 0 | 1 | 2 | 3 | 4 — overall strength.
• entropyBits: number — estimated entropy after pattern-based reductions.
• reasons: string[] — why the score was lowered (empty if no penalties).
• suggestions: string[] — actionable feedback for the user.
• patterns: PatternHit[] — detected patterns (kind, detail, span).
• crackTimes: CrackTimeEstimate[] — one entry per guess-rate scenario.

GUESS_RATES

Documented guesses-per-second constants used for crack-time estimation:

| Scenario | Rate | Represents | |---|---|---| | onlineThrottled | 100/hour | rate-limited login form | | onlineUnthrottled | 10/sec | login form with weak/no rate limiting | | offlineSlowHash | 10,000/sec | offline attack against bcrypt/scrypt/argon2 | | offlineFastHash | 10,000,000,000/sec | offline attack against unsalted MD5/SHA1 on GPUs |

COMMON_PASSWORDS: readonly string[]

The built-in common-password list used for matching (see Limits).

Limits

password-strength-lite is smaller and less accurate than zxcvbn. Concretely:

• The common-password list ships ~700 entries, compiled from widely published breach-analysis lists. zxcvbn ships frequency-ranked dictionaries covering hundreds of thousands of passwords, names, and English words. A password not on this list will not be flagged as common even if it is, in reality, common.
• Pattern detection covers repeats, straight sequences, a handful of keyboard-row layouts, year-like numbers, and basic leetspeak substitution. zxcvbn's pattern matchers are considerably more sophisticated (date parsing, l33t variants per-token, spatial keyboard graphs for multiple layouts, regex-based repeat detection with base-token scoring).
• Entropy is computed with a straightforward pool-size × length formula with linear penalties subtracted for detected patterns — not a full minimum-guesses search over token decompositions like zxcvbn's dynamic programming approach.
• Crack-time estimates use fixed guess-rate constants; real attacker throughput varies by hardware, hash algorithm, and rate limiting.

Use this library for lightweight, client-side strength meters and inline suggestions. Do not rely on it as the sole gate for high-stakes flows — use zxcvbn (or a server-side breach-corpus check like Have I Been Pwned's k-anonymity API) wherever an underestimate has real consequences.

Part of the ferrow-toolkit collection · Sponsored by Ferrow