A simple way to check that password strength of a certain passphrase. A password strength checker based from Javascript RegEx.
npm i check-password-strength --save
Install via Browser Script Tag using UNPKG
<script src="https://unpkg.com/check-password-strength/dist/umd.js"></script>
<script type="text/javascript">
const passwordStrength = checkPasswordStrength.passwordStrength('pwd123').value; // 'Weak'
</script>const { passwordStrength } = require('check-password-strength')
// OR
import { passwordStrength } from 'check-password-strength'
console.log(passwordStrength('asdfasdf').value)
// Too weak (It will return Too weak if the value doesn't match the Weak conditions)
console.log(passwordStrength('asdf1234').value)
// Weak
console.log(passwordStrength('Asd1234!').value)
// Medium
console.log(passwordStrength('A@2asdF2020!!*').value)
// Strong| Property | Desc. |
|---|---|
| id | 0 = Too weak, 1 = Weak & 2 = Medium, 3 = Strong |
| value | Too weak, Weak, Medium & Strong |
| contains | lowercase, uppercase, symbol and/or number |
| length | length of the password |
| Name | Mininum Diversity | Mininum Length |
|---|---|---|
| Too weak | 0 | 0 |
| Weak | 2 | 6 |
| Medium | 4 | 8 |
| Strong | 4 | 10 |
console.log(passwordStrength('@Sdfasd2020!@#$'))
// output
{
"id": 1,
"value": "Strong",
"contains": ['lowercase', 'uppercase', 'symbol', 'number'],
"length": 15
}The default symbols are based from Password Special Characters OWASP list (except for the space)
!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
Thanks for jlherren & Ennoriel for this suggestion! 👨🏻💻👨🏻💻
The default options can be required:
const { defaultOptions } = require("./index");default options:
[
{
id: 0,
value: "Too weak",
minDiversity: 0,
minLength: 0
},
{
id: 1,
value: "Weak",
minDiversity: 2,
minLength: 6
},
{
id: 2,
value: "Medium",
minDiversity: 4,
minLength: 8
},
{
id: 3,
value: "Strong",
minDiversity: 4,
minLength: 10
}
]To override the default options, simply pass your custom array as the second argument:
- id: correspond to the return id attribute.
- value: correspond to the return value attribute.
- minDiversity: between 0 and 4, correspond to the minimum of different criterias ('lowercase', 'uppercase', 'symbol', 'number') that should be met to pass the password strength
- minLength: minimum length of the password that should be met to pass the password strength
The minDiversity and minLength parameters of the first element cannot be overriden (set to 0 at the beginning of the method). Therefore, the first element should always correspond to a "too weak" option.
passwordStrength('myPassword', yourCustomOptions)Strong
^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[!@#$%^&*"'()+,-./:;<=>?[\]^_`{|}~])(?=.{10,})
Medium Password RegEx used:
^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[!@#$%^&*"'()+,-./:;<=>?[\]^_`{|}~])(?=.{8,})
| RegEx | Desc. |
|---|---|
| ^ | The password string will start this way |
| (?=.*[a-z]) | The string must contain at least 1 lowercase alphabetical character |
| (?=.*[A-Z]) | The string must contain at least 1 uppercase alphabetical character |
| (?=.*[0-9]) | The string must contain at least 1 numeric character |
| (?=.[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~])) | The string must contain at least one special character |
| (?=.{10,}) | The string must be eight characters or longer for Strong strength |
| (?=.{8,}) | The string must be eight characters or longer for Medium strength |
| (?=.{6,}) | Mininum of 6 characters for Weak strength |
Available starting version v2.0.3 and above. (Thanks to @Mesoptier!)
If you're working with .net core project, I've created a simple nuget package with same RegEx strings to validate a password strength.
You can easily install via Nuget Package Manager or .NET CLI (Check.Password.Strength). This package uses Regular Expression new Regex() derives from System.Text.RegularExpressions. You can use this especially if you want to validate the passcode strength on backend services or web apis of your project.
I also made another NPM package (hey-regex) that checks common inputs like numbers (whole number and decimal), alpha numeric, email and url. This package only returns true or false based from the selected function (with RegEx .test() inside).
Reference blog.
Feel free to clone or fork this project: https://github.com/deanilvincent/check-password-strength.git
Contributions & pull requests are welcome!
I'll be glad if you give this project a ★ on Github :)
Kudos to @Ennoriel and his efforts for making v2.x.x possible!
This project is licensed under the MIT License - see the LICENSE.md file for details.
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent