{"_id":"@alikia/zxcvbn","name":"@alikia/zxcvbn","dist-tags":{"latest":"6.3.0"},"versions":{"6.3.0":{"name":"@alikia/zxcvbn","version":"6.3.0","description":"Realistic password strength estimation, enhanced version of zxcvbn.","author":{"name":"alikia2x"},"license":"MIT","main":"./dist/index.mjs","types":"./dist/index.d.ts","repository":{"type":"git","url":"git+https://github.com/alikia2x/zxcvbn.git"},"bugs":{"url":"https://github.com/alikia2x/zxcvbn/issues"},"contributors":[{"name":"Dan Wheeler"},{"name":"Tony Richards"}],"scripts":{"test":"vitest","build":"vite build","format":"prettier --write ."},"devDependencies":{"@typescript-eslint/eslint-plugin":"^5.0.0","@typescript-eslint/parser":"^5.0.0","browserify":"^17.0.0","commitizen":"^4.2.3","coveralls":"^3.1.0","cz-conventional-changelog":"^3.3.0","eslint":"^8.0.0","eslint-config-prettier":"^8.0.0","eslint-plugin-import":"^2.22.1","eslint-plugin-prettier":"^4.0.0","husky":"^8.0.0","make-dir-cli":"^3.0.0","prettier":"^2.2.1","typescript":"^4.1.5","uglifyify":"^5.0.2","vite":"^5.4.0","vite-plugin-dts":"^4.0.2","vitest":"^2.0.5"},"keywords":["password","passphrase","security","authentication","strength","meter","quality","estimation","pattern","cracking","scoring","entropy","bruteforce"],"_id":"@alikia/zxcvbn@6.3.0","gitHead":"013118ad089224a7170461b60a298ea946f44a62","homepage":"https://github.com/alikia2x/zxcvbn#readme","_nodeVersion":"22.4.0","_npmVersion":"10.8.1","dist":{"integrity":"sha512-phSsYL7iisoWd7eTNMg1LocSWdFcoYtpWKPE7D9Ex+/qReuW72wjkyrhbvu5kV6wY5qxx/mlDYXrj+LLpdG+SA==","shasum":"ab6af1cf2f211117d3fb58dafa30523d35d7da08","tarball":"https://registry.npmjs.org/@alikia/zxcvbn/-/zxcvbn-6.3.0.tgz","fileCount":49,"unpackedSize":2603923,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDHSZ55eT+Ab5GomczN5c72SFPwRSBh+ZB2xW7Q+VbR3wIgBhNv1yIweNYwxxkMwBtnv/W3q4rJb0QlxQHTsZD05i8="}]},"_npmUser":{"name":"alikia2x","email":"ziwen243@outlook.com"},"directories":{},"maintainers":[{"name":"alikia2x","email":"ziwen243@outlook.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/zxcvbn_6.3.0_1723540872061_0.6208532225150896"},"_hasShrinkwrap":false}},"time":{"created":"2024-08-13T09:21:11.972Z","6.3.0":"2024-08-13T09:21:12.307Z","modified":"2024-08-13T09:21:12.598Z"},"maintainers":[{"name":"alikia2x","email":"ziwen243@outlook.com"}],"description":"Realistic password strength estimation, enhanced version of zxcvbn.","homepage":"https://github.com/alikia2x/zxcvbn#readme","keywords":["password","passphrase","security","authentication","strength","meter","quality","estimation","pattern","cracking","scoring","entropy","bruteforce"],"repository":{"type":"git","url":"git+https://github.com/alikia2x/zxcvbn.git"},"contributors":[{"name":"Dan Wheeler"},{"name":"Tony Richards"}],"author":{"name":"alikia2x"},"bugs":{"url":"https://github.com/alikia2x/zxcvbn/issues"},"license":"MIT","readme":"# zxcvbn\n\nThis is a enhanced version of Dropbox's [zxcvbn](https://github.com/dropbox/zxcvbn) library.\n\n`zxcvbn` is a password strength estimator inspired by password crackers. Through pattern matching and conservative estimation, it recognizes and weighs 30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (`aaa`), sequences (`abcd`), keyboard patterns (`qwertyuiop`), l33t speak, and also \"strong\" passwords that satisfy many website's rules for passwords, but still leaked.\n\nConsider using zxcvbn as an algorithmic alternative to password composition policy — it is more secure, flexible, and usable when sites require a minimal complexity score in place of annoying rules like \"passwords must contain three of {lower, upper, numbers, symbols}\".\n\n-   **More secure**: policies often fail both ways, allowing weak passwords (`P@ssword1`) and disallowing strong passwords.\n-   **More flexible**: zxcvbn allows many password styles to flourish so long as it detects sufficient complexity — passphrases are rated highly given enough uncommon words, keyboard patterns are ranked based on length and number of turns, and capitalization adds more complexity when it's unpredictaBle.\n-   **More usable**: zxcvbn is designed to power simple, rule-free interfaces that give instant feedback. In addition to strength estimation, zxcvbn includes minimal, targeted verbal feedback that can help guide users towards less guessable passwords.\n\nFor further detail and motivation, please refer to the USENIX Security '16 [paper and presentation](https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler).\n\n## Usage\n\n[try zxcvbn interactively](https://lowe.github.io/tryzxcvbn/) to see these docs in action.\n\n```typescript\nzxcvbn(password, (user_inputs = []));\n```\n\n`zxcvbn()` takes one required argument, a password, and returns a result object with several properties:\n\n```typescript\n{\n  guesses : number, // estimated guesses needed to crack password\n  guesses_log10 : number, // order of magnitude of guesses\n\n  crack_times_seconds : // dictionary of back-of-the-envelope crack time estimations, in seconds, based on a few scenarios:\n  {\n    // online attack on a service that ratelimits password auth attempts.\n    online_throttling_100_per_hour : number,\n\n    // online attack on a service that doesn't ratelimit, or where an attacker has outsmarted ratelimiting.\n    online_no_throttling_10_per_second : number,\n\n    // offline attack. assumes multiple attackers,  proper user-unique salting, and a slow hash function\n    // w/ moderate work factor, such as bcrypt, scrypt, PBKDF2.\n    offline_slow_hashing_1e4_per_second : number,\n\n    // offline attack with user-unique salting but a fast hash function like SHA-1, SHA-256 or MD5. A wide range of\n    // reasonable numbers anywhere from one billion - one trillion  guesses per second, depending on number of cores\n    // and machines. ballparking at 10B/sec.\n    offline_fast_hashing_1e10_per_second : number,\n  },\n  crack_times_display, // same keys as result.crack_times_seconds, with friendlier display string values: \"less than a second\", \"3 hours\", \"centuries\", etc.\n  score : number,      // Integer from 0-4 (useful for implementing a strength bar)\n                       // 0 - too guessable: risky password. (guesses < 10^3)\n                       // 1 - very guessable: protection from throttled online attacks. (guesses < 10^6)\n                       // 2 - somewhat guessable: protection from unthrottled online attacks. (guesses < 10^8)\n                       // 3 - safely unguessable: moderate protection from offline slow-hash scenario. (guesses < 10^10)\n                       // 4 - very unguessable: strong protection from offline slow-hash scenario. (guesses >= 10^10)\n  feedback : // verbal feedback to help choose better passwords. set when score <= 2.\n  {\n    warning : string, // explains what's wrong, eg. 'this is a top-10 common password'.  Not always set -- sometimes an empty string\n    suggestions : string[],  // a possibly-empty list of suggestions to help choose a less guessable password. eg. 'Add another word or two'\n  },\n  sequence : [], // the list of patterns that zxcvbn-typescript based the guess calculation on.\n  calc_time : number // how long it took zxcvbn-typescript to calculate an answer in milliseconds.\n}\n```\n\nThe optional `user_inputs` argument is an array of strings that zxcvbn-typescript will treat as an extra dictionary. This can be whatever list of strings you like, but is meant for user inputs from other fields of the form, like name and email. That way a password that includes a user's personal information can be heavily penalized. This list is also good for site-specific vocabulary — Acme Brick Co. might want to include ['acme', 'brick', 'acmebrick', etc].\n\n## Performance\n\nzxcvbn operates below human perception of delay for most input: ~5-20ms for ~25 char passwords on modern browsers/CPUs, ~100ms for passwords around 100 characters. To bound runtime latency for really long passwords, consider sending `zxcvbn()` only the first 100 characters or so of user input.\n\n## Acknowledgments\n\nDan Wheeler for the initial zxcvbn project.\n[Dropbox](https://dropbox.com) for supporting open source!\n\nTony Richards for the Typescript version.\n\nMark Burnett for releasing his 10M password corpus and for his 2005 book, [Perfect Passwords: Selection, Protection, Authentication](http://www.amazon.com/Perfect-Passwords-Selection-Protection-Authentication/dp/1597490415).\n\nWiktionary contributors for building a [frequency list of English words](http://en.wiktionary.org/wiki/Wiktionary:Frequency_lists) as used in television and movies.\n\nResearchers at Concordia University for [studying password estimation rigorously](http://www.concordia.ca/cunews/main/stories/2015/03/25/does-your-password-pass-muster.html) and recommending zxcvbn.\n\nAnd [xkcd](https://xkcd.com/936/) for the inspiration :+1::horse::battery::heart:\n","readmeFilename":"README.md"}