Lightweight, dependency-free password strength estimator. Estimates entropy from character-class pool + length, applies pattern penalties (repeats, sequences, keyboard runs, years, leetspeak substitutions), checks against a built-in common-password list, and returns a 0-4 score with reasons, suggestions, and crack-time estimates at four documented guess rates.
This is smaller and less accurate than zxcvbn — use zxcvbn for high-stakes flows (account signup for a bank, password managers, anything where an underestimate has real consequences). This library is meant for lightweight UI feedback (a strength meter, inline suggestions) where a "good enough" heuristic beats no feedback at all, at a fraction of zxcvbn's bundle size and with zero runtime dependencies.
npm install @ferrow/password-strength-liteimport { estimateStrength } from "password-strength-lite";
const result = estimateStrength("password123");
// {
// score: 0,
// entropyBits: 0,
// reasons: [
// 'matches a common password (with or without common substitutions)',
// 'contains a predictable sequence (e.g. "abc", "123")',
// 'contains a keyboard-adjacent pattern (e.g. "qwerty", "asdf")'
// ],
// suggestions: [...],
// patterns: [...],
// crackTimes: [
// { scenario: 'onlineThrottled', guessesPerSecond: 0.0278, seconds: 36, display: '36 seconds' },
// { scenario: 'onlineUnthrottled', guessesPerSecond: 10, seconds: 0.1, display: '0.1 seconds' },
// { scenario: 'offlineSlowHash', guessesPerSecond: 10000, seconds: 0, display: '0 seconds' },
// { scenario: 'offlineFastHash', guessesPerSecond: 1e10, seconds: 0, display: '0 seconds' }
// ]
// }Run npm run build && npm run demo to see the full demo, including a
diceware-style passphrase scoring 4/4.
Returns:
score: 0 | 1 | 2 | 3 | 4— overall strength.entropyBits: number— estimated entropy after pattern-based reductions.reasons: string[]— why the score was lowered (empty if no penalties).suggestions: string[]— actionable feedback for the user.patterns: PatternHit[]— detected patterns (kind,detail,span).crackTimes: CrackTimeEstimate[]— one entry per guess-rate scenario.
Documented guesses-per-second constants used for crack-time estimation:
| Scenario | Rate | Represents |
|---|---|---|
onlineThrottled |
100/hour | rate-limited login form |
onlineUnthrottled |
10/sec | login form with weak/no rate limiting |
offlineSlowHash |
10,000/sec | offline attack against bcrypt/scrypt/argon2 |
offlineFastHash |
10,000,000,000/sec | offline attack against unsalted MD5/SHA1 on GPUs |
The built-in common-password list used for matching (see Limits).
password-strength-lite is smaller and less accurate than zxcvbn. Concretely:
- The common-password list ships ~700 entries, compiled from widely published breach-analysis lists. zxcvbn ships frequency-ranked dictionaries covering hundreds of thousands of passwords, names, and English words. A password not on this list will not be flagged as common even if it is, in reality, common.
- Pattern detection covers repeats, straight sequences, a handful of keyboard-row layouts, year-like numbers, and basic leetspeak substitution. zxcvbn's pattern matchers are considerably more sophisticated (date parsing, l33t variants per-token, spatial keyboard graphs for multiple layouts, regex-based repeat detection with base-token scoring).
- Entropy is computed with a straightforward pool-size × length formula with linear penalties subtracted for detected patterns — not a full minimum-guesses search over token decompositions like zxcvbn's dynamic programming approach.
- Crack-time estimates use fixed guess-rate constants; real attacker throughput varies by hardware, hash algorithm, and rate limiting.
Use this library for lightweight, client-side strength meters and inline suggestions. Do not rely on it as the sole gate for high-stakes flows — use zxcvbn (or a server-side breach-corpus check like Have I Been Pwned's k-anonymity API) wherever an underestimate has real consequences.
Part of the ferrow-toolkit collection · Sponsored by Ferrow