5 ms·

Those rules are encoded pretty well in this library: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ https://blogs.dropbox

• ryan-c 10y ago
  A problem with zxcvbn fails badly at passphrase evaluation - for example it will claim "all your base are belong to us" would take centuries to crack.
  • andybak 10y ago
    I assume you mean "it's long but a commonly chosen long password" Do you have evidence that is a commonly used password? I'm genuinely curious. The people geeky enough to know that meme might be slightly more likely to understand why it's a poor choice of password.
    • ryan-c 10y ago
      It was just a random example, but a couple years ago I found 250 BTC with a private key of sha256("how much wood could a woodchuck chuck if a woodchuck could chuck wood"). People use quotes from movies/tv/books/etc for stuff that matters.
  • FabHK 10y ago
    Still better than most other password quality checkers. In a sense, they can all only tell you that something is certainly a bad password, or maybe a good one. It's a very hard problem, and zxcvbn does a much better job than most (more naive) tools.
  • Buge 10y ago
    It estimates 79.6 bits of entropy. It's basing the estimate on just the words, not on the popularity of the phrase as a whole. Let's compare that to https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm which many people promote as a good password checker, but is actually terrible. It claims 177 bits of entropy. This is basing the estimate on just the individual characters.