camandel/check-password-strength

check-password-strength

check-password-strength is a tool that runs on Linux, Windows and MacOS that could help you to check how your passwords are good. It reads data from a CSV file, user input or stdin and assigns a score to each password within a range from 0 (worst) to 4 (best):

$ docker run --rm --net none -v $PWD:/data:ro camandel/check-password-strength -f /data/password.csv
        URL       |   USERNAME   | PASSWORD |   SCORE (0-4)    | ESTIMATED TIME TO CRACK | ALREADY USED  
------------------+--------------+----------+------------------+-------------------------+---------------
  www.example.com | user1        | s******r |  0 - Really bad  | instant                 |               
  www.example.com | user2        | 5******r |  0 - Really bad  | instant                 |               
  www.example.com | dhakjdhas777 | d******7 |  0 - Really bad  | instant                 |               
  www.example.com | user1        | s******1 |  1 - Bad         | 61.0 minutes            |               
  www.example.com | user3        | b******9 |  2 - Weak        | 5.0 days                |               
  www.example.com | 1111         | 8******3 |  2 - Weak        | 10.0 hours              |               
  www.example.com | user3        | h******w |  3 - Good        | 10.0 months             |               
  www.example.com | user3        | p******t |  4 - Strong      | centuries               | 40c08664      
  www.example.com | user2        | G******x |  4 - Strong      | centuries               |               
  www.example.com | user2        | p******t |  4 - Strong      | centuries               | 40c08664

$ docker run --rm --net none -ti camandel/check-password-strength -i
Enter Username: username
Enter Password: 
  URL | USERNAME | PASSWORD |   SCORE (0-4)    | ESTIMATED TIME TO CRACK | ALREADY USED  
------+----------+----------+------------------+-------------------------+---------------
      | username | p******d |  0 - Really bad  | instant                 |

It's based on the awesome https://github.com/dropbox/zxcvbn library and its Go porting github.com/nbutton23/zxcvbn-go.

The passwords will be checked on:

• english words and names
• italian words and names
• common used passwords
• common keyboards sequences
• l33t substitutions
• username as part of the password
• duplicated passwords
• a custom dictionary can be loaded at runtime

It supports CSV files exported from the most popular Password Managers and Browsers:

• LastPass
• Bitwarden
• Keepass
• Firefox
• Chrome
• Custom (*)

(*) the custom CSV files must have a header with at least the following three fields: url,username,password

To check only one password at a time it can be used in interactive mode (password will not be displayed as you type):

$ check-password-strength -i
Enter Username: username
Enter Password: 
  URL | USERNAME | PASSWORD |   SCORE (0-4)    | ESTIMATED TIME TO CRACK | ALREADY USED   
------+----------+----------+------------------+-------------------------+---------------
      | username | p******d |  0 - Really bad  | instant                 |

or reading from stdin:

$ echo $PASSWORD | check-password-strength
  URL | USERNAME | PASSWORD |   SCORE (0-4)    | ESTIMATED TIME TO CRACK | ALREADY USED  
------+----------+----------+------------------+-------------------------+---------------
      |          | p******j |  4 - Strong      | centuries               |

If you need to use it in a script you can use -q flag. It will display nothing on stdout and the exit code will contain the password score (it works only with single password):

$ echo $PASSWORD | ./check-password-strength -q
$ echo $?
4

Getting started

Install

Installation of check-password-strength is simple, just download https://github.com/camandel/check-password-strength/releases and run the binary:

$ chmod +x check-password-strength
$ ./check-password-strength -f password.csv

or run it in a Docker container:

$ docker run --rm --net none -v $PWD:/data:ro camandel/check-password-strength -f /data/password.csv

Building from source

$ git clone https://github.com/camandel/check-password-strength

$ cd check-password-strength

$ # it compiles for current OS and ARCH
$ make

For Linux

shell
$ make linux-64

For MacOS

shell
$ make macos-64

For Windows

shell
$ make windows-32

or

shell
$ make windows-64

For Docker image

shell
$ make docker

It will create a local image called check-password-strength:latest

Run

You can use command line or the Docker image:

CODE_TOKEN_12

How to add custom dictionary

If you need to add your custom dictionary to the integrated ones, create one json file in the following format:

CODE_TOKEN_13 and load it at runtime with the -c flag: CODE_TOKEN_14 Or add it directly into the binary copying the json file in assets/data and recompile.

Source code

https://github.com/camandel/check-password-strength