Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Guidelines for a Password Strength Meter (Password checker) Design [closed]

I have tried different types of Password Strength Meters or Password checkers, but all give me different results when I test the same Password, because each implements its own algorithm.

Is there some official standard or guideline that can follow me to build my own Password Strength Meter.

If there was no official standard, what features should a good Password Strength Meter check for?

like image 865
RRUZ Avatar asked Jan 15 '10 21:01

RRUZ


People also ask

What is password strength checker?

Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly.

How do I create a password strength tester?

Password Strength Checker JavaScript [Source Codes] First, you need to create two Files: HTML and CSS File. After creating these files just paste the following codes in your file. First, create an HTML file with the name of index. html and paste the given codes into your HTML file.

Is it safe to use password strength checker?

So, password meters are not a reliable guide to how likely it is that your password will be cracked but they do seem to nudge people in the direction of creating stronger passwords in general.

How does your password measure up the effect of strength meters on password creation?

We found that meters with a variety of visual appearances led users to create longer passwords. However, significant increases in resistance to a password-cracking algorithm were only achieved using meters that scored passwords stringently.


2 Answers

As far as I know there is no standard as there are many definitions of what a good (i.e. strong) password should be.

Some things to consider:

  • Length - the longer the better
  • Mixed case
  • Includes numbers as well as characters
  • Includes non alpha numeric characters
  • Isn't a dictionary word
  • Is a phrase

and so on

like image 21
ChrisF Avatar answered Oct 30 '22 01:10

ChrisF


Consider the following:

  • Length
  • Mixed case
  • Not many repeated characters
  • Includes letters, numbers, and symbols
  • Does not include part of the username
  • Not similar to prior passwords
  • Does not hash to the same thing as a weak password
  • Is not a keyboard walk
  • Is not related to the individual
  • Does not end with the common suffixes
  • Does not start with the common prefixes

See Bruce Schneier's post on passwords as well as this post.

like image 53
Kaleb Pederson Avatar answered Oct 30 '22 00:10

Kaleb Pederson