7

I have tried different types of Password Strength Meters or Password checkers, but all give me different results when I test the same Password, because each implements its own algorithm.

Is there some official standard or guideline that can follow me to build my own Password Strength Meter.

If there was no official standard, what features should a good Password Strength Meter check for?

Paul Sasik
  • 79,492
  • 20
  • 149
  • 189
RRUZ
  • 134,889
  • 20
  • 356
  • 483
  • 2
    I think standardization of the algorithm would undermine its strength, as malefactors would have a well and narrowly defined set of rules to leverage when attempting to crack passwords. It would be much easier to hack your password if I knew that it had 2-3 numbers, 5-6 letters, and 1 of a small set of punctuation, than if I were more in the dark about your particular criteria. Not an answer, I know. – Jay Jan 15 '10 at 21:41

6 Answers6

3

Consider the following:

  • Length
  • Mixed case
  • Not many repeated characters
  • Includes letters, numbers, and symbols
  • Does not include part of the username
  • Not similar to prior passwords
  • Does not hash to the same thing as a weak password
  • Is not a keyboard walk
  • Is not related to the individual
  • Does not end with the common suffixes
  • Does not start with the common prefixes

See Bruce Schneier's post on passwords as well as this post.

Kaleb Pederson
  • 45,767
  • 19
  • 102
  • 147
1

As far as I know there is no standard as there are many definitions of what a good (i.e. strong) password should be.

Some things to consider:

  • Length - the longer the better
  • Mixed case
  • Includes numbers as well as characters
  • Includes non alpha numeric characters
  • Isn't a dictionary word
  • Is a phrase

and so on

ChrisF
  • 134,786
  • 31
  • 255
  • 325
  • "Includes no alpha numeric characters"? You just said in the line before "Includes numbers as well as characters" which is alpha-numeric? – Kaleb Pederson Jan 15 '10 at 21:42
0

I'd also add : Doesn't include the username string, or even a part of the username if it's a long one.

Daan
  • 1,879
  • 17
  • 18
0

I'll throw another criterion in the ring:

  • No "keyboard walks"

Because so many people expect users to remember passwords that are difficult to remember, they resort to keyboard patterns to tame the madness. Throw in shifted versions for good measure.

Oh, and nothing on Twitter's forbidden password list, either.

John
  • 15,990
  • 10
  • 70
  • 110
0

There are a number of guidelines (google) that give guidance on what makes a strong password, most of which is common sense. At the end of the day you can apply your own policy (or Company policy if they have one) for what is strong and what is not and your decision would probably be influenced by what it is you are trying to protect.

As @jay said, I don't think standardising such a thing would be a wise practice!

http://net.tutsplus.com/tutorials/javascript-ajax/build-a-simple-password-strength-checker/

http://www.ibm.com/developerworks/lotus/library/ls-password_quality/index.html#N100F5

Thought this site was particularly good as it gives an idea of the algorithm they are applying and how they calculate strength.

http://www.passwordmeter.com/

David
  • 3,519
  • 1
  • 24
  • 30
0

Strength of a password should be checked on behalf of several parameters like the presence of special characters and numbers, length of the password etc.

Please check this link:

http://tinytute.com/2014/06/03/animated-password-strength-checker-quick-easy/

The jQuery code block:

$(document).ready(function(){

$("#textBox").keyup(function(){

    var passWord = $("#textBox").val();
    var passLength = passWord.length;
    var specialFlag = 0;
    var numberFlag = 0;
    var numberGenerator = 0;
    var total = 0;

    if(/^[a-zA-Z0-9- ]*$/.test(passWord) == false) {

        specialFlag =20;
    }


    if(passWord.match(/[0-9]/)) {

        numberFlag = 25;
    }

    if(passLength>4&&passLength<=6){
        numberGenerator =25;
    }else if(passLength>=7&&passLength<=9){
        numberGenerator =35;
    }else if(passLength>9){
        numberGenerator =55;
    }else if(passLength>0&&passLength<=4){
        numberGenerator =15;
    }else{
        numberGenerator =0;
    }

    total = numberGenerator + specialFlag + numberFlag;
    if(total<30){
        $('#progressBar').css('background-color','#CCC');
    }else if(total<60&&total>=30){

        $('#progressBar').css('background-color','#FF6600');

    }else if(total>=60&&total<90){

        $('#progressBar').css('background-color','#FFCC00');

    }else if(total>=90){

        $('#progressBar').css('background-color','#0f0');

    }
    $('#progressBar').css('width',total+'%');

});

});

Anjan
  • 1