zxcvbn
A library that estimates how strong a password is by checking common patterns.
- Stars
- 16.1k
- Forks
- 1k
- Licence
- MIT
- Language
- CoffeeScript
- Last update
- 2.2 years ago
- Type
- Library
No commits in over a year — check for forks or alternatives before adopting.
What it is
zxcvbn is a password strength estimator that checks a password against common passwords, names, dictionary words, dates, keyboard patterns, and simple substitutions like l33t speak. It returns a score from 0 to 4, an estimated number of guesses, and short feedback messages so sites can guide users toward harder-to-guess passwords. It is a JavaScript library that also runs on Node.js, and the README says Dropbox uses it in its clients.
- Show a live strength bar while a user types a new password
- Return feedback such as warnings and suggestions when a password scores 2 or lower
- Check passwords on the server with the Node npm package
- Pass user-specific words such as a username as extra inputs so they are penalized
Great for
- Developers adding a password strength meter to a sign-up or password reset form
- Teams that want to replace strict composition rules with a strength score
- Projects that need a JavaScript password checker that runs in the browser or on a server
- Developers porting password strength checks to another language using one of the listed ports
Not ideal for
- People who need a ready-made app; this is a library that must be built into other software
- Projects that cannot load a library of several hundred kilobytes on pages where passwords are entered, since the README says the minified bundle is still several hundred kilobytes
- Anyone expecting a guarantee of security; the README describes estimates, not certainty
How to get it
- 1
Install with a package manager
You'll need: Node.js (for the npm install method)
Install with npm
npm install zxcvbn - 2
Run it
- Install the package with npm install zxcvbn
- In Node, run var zxcvbn = require('zxcvbn');
- Call zxcvbn('Tr0ub4dour&3') to see the result object
- Read result.score and result.feedback to show a strength meter
- 3
Get the most out of it
- Pass user_inputs such as the username or email to zxcvbn(password, user_inputs) so those words are penalized
- Use result.crack_times_display for friendly time estimates
- Load zxcvbn only on pages with password fields, as the README recommends, to reduce page load cost
- Use the ports listed in the README if your project is not in JavaScript
Downloads
Strengths
- The README describes it as based on a USENIX Security '16 paper, with a linked paper and presentation
- Works in browsers and on Node.js, and supports CommonJS, AMD, and global script use
- Has many language ports listed in the README, covering Python, Java, Go, Rust, and others
Trade-offs
- The README says the minified bundle is several hundred kilobytes, which is large for a front-end check
- Strength is estimated from known patterns and word lists, so unusual passwords may be scored differently than an attacker would expect
- The README is truncated here, so details beyond the usage section are unclear
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.