Realistic PHP password strength estimate library based on Zxcvbn JS
Realistic PHP password strength estimate library based on Zxcvbn JS
Zxcvbn-PHP is a password strength estimator using pattern matching and minimum entropy calculation. Zxcvbn-PHP is based on the the Javascript zxcvbn project from Dropbox and @lowe. "zxcvbn" is bad password, just like "qwerty" and "123456".
zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calculations. It finds 10k common passwords, common American names and surnames, common English words, and common patterns like dates, repeats (aaa), sequences (abcd), and QWERTY patterns.
The library can be installed with Composer by adding it as a dependency to your composer.json file.
Via the command line run:
composer require bjeavons/zxcvbn-php
Or in your composer.json add
{
"require": {
"bjeavons/zxcvbn-php": "^1.0"
}
}Then run composer update on the command line and include the
autoloader in your PHP scripts so that the ZxcvbnPhp class is available.
require_once 'vendor/autoload.php';use ZxcvbnPhp\Zxcvbn;
$userData = [
'Marco',
'[email protected]'
];
$zxcvbn = new Zxcvbn();
$weak = $zxcvbn->passwordStrength('password', $userData);
echo $weak['score']; // will print 0
$strong = $zxcvbn->passwordStrength('correct horse battery staple');
echo $strong['score']; // will print 4
echo $weak['feedback']['warning']; // will print user-facing feedback on the password, set only when score = 10^10) and provides strong protection from offline slow-hash scenario
### Acknowledgements
Thanks to:
* @lowe for the original [Javascript Zxcvbn](https://github.com/lowe/zxcvbn)
* [@Dreyer's port](https://github.com/Dreyer/php-zxcvbn) for reference for initial implementation
* [@mkopinsky](https://github.com/mkopinsky) for major updates to keep in sync with upstream scoringNo open issues yet, or sync has not completed.