Password Strength Checker

A lightweight JavaScript library to evaluate password strength using entropy calculation, crack-time estimation, and rule-based feedback.

Installation

npm install @kesavandev/password-strength-checker

Usage

const { checkPassword } = require("@kesavandev/password-strength-checker");

const result = checkPassword("P@ssw0rd123");

console.log(result);

Example Output

{
  "entropy": 52.34,
  "strength": "Strong",
  "crackTime": "3.25 hours",
  "feedback": []
}

Features

• Entropy-based password strength calculation

• Crack time estimation based on brute-force attack assumptions

• Feedback system for improving weak passwords

• Detection of:

  • Short passwords
  • Missing character types (uppercase, lowercase, numbers, symbols)
  • Common passwords (basic list)
  • Repeated characters

How It Works

1. Charset Detection

The library identifies the types of characters used:

• Lowercase letters
• Uppercase letters
• Numbers
• Special characters

2. Entropy Calculation

Entropy is calculated using:

entropy = password_length × log2(character_set_size)

This estimates how unpredictable the password is.

3. Crack Time Estimation

The library estimates how long it would take to brute-force the password using a fixed guess rate.

Note: This is an approximation and may not reflect real-world attack scenarios.

4. Strength Classification

| Entropy Range | Strength | | ------------- | ----------- | | < 28 | Very Weak | | 28 – 35 | Weak | | 36 – 59 | Moderate | | 60 – 79 | Strong | | 80+ | Very Strong |

Feedback Messages

The library provides suggestions such as:

• Use at least 12 characters
• Add uppercase or lowercase letters
• Include numbers and symbols
• Avoid repeated characters
• Avoid common passwords

Limitations

This library uses a simplified entropy model and basic pattern checks.

• Does not include large password dictionaries
• Does not detect advanced patterns (keyboard sequences, substitutions)
• Crack-time estimates are theoretical

For advanced use cases, consider more comprehensive solutions like dedicated password strength estimators.

License

MIT