7

I'm curious as to how the strength of a password is calculated, because the password I just entered wasn't classed at full strength:

When it is full for Google, Medium for Microsoft and Full for another online checker:

This is the password:

d'c<nKZwSX64

(no I'm not using it for anything).

So what is the score based on here?

Improve this question
3

2 Answers 2

Reset to default
6

As Daniel said, libpwquality is used. Looking in source code, you can see several checks, quality settings - threshholds - will be configured in a configuration file:

  • palindromes
  • simplicity (too little number of digits, lower chars, upper chars and special chars)
  • simplicity (too little different character types - digits, lower chars, upper chars and special chars)
  • Consecutivity (too many repeated characters)
  • similarity to user id or user full name
  • wordlist (bad words from config file)

There are checks for comparing old and new passwords, too.

Improve this answer
5

We use a library called libpwquality

Improve this answer
3
  • @Tim To be honest, I don't personally know the answer to that :p I think it's basically trying to calculate "entropy". If you just keep typing non-repeating lowercase letters you can get a full score after like 20 lowercase characters. Using symbols and mixed case you can get a full score in less chars. But I think the idea is that it's trying to find out how hard it would be to bruteforce this password
    – Daniel Foré
    Jul 1, 2015 at 16:04
  • @Tim I'm unsure. I haven't personally read that code.
    – Daniel Foré
    Jul 2, 2015 at 2:26
  • 1
    It's fundamentally impossible to make a password strength meter since password strength depends on the generation process, not on the result. Password strength meters range from the dangerously misleading to the merely sometimes-useful. I don't know how this library fares. Can you point to the discussion that led you to choosing this one (over others and over none at all)? Do you offer password choice recommendations?
    – Gilles 'SO- stop being evil'
    Jul 2, 2015 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.