zxcvbn: Low-Budget Password Strength Estimation | USENIX
Posted by jpluimers on 2025/06/19
Many web-sites and password managers have a strength indicator built-in.
This is a really good example (with open source JavaScript code!) of one: [Wayback/Archive] zxcvbn: Low-Budget Password Strength Estimation | USENIX
Be aware though that it stores a plain text file named passwords.txt on your system (this seems to confuse some users, especially when their password is in it).
Homans password behaviour does not change much over time, so this half hour 2016 presentation on it is still current: [Wayback/Archive] USENIX Security ’16 – zxcvbn: Low-Budget Password Strength Estimation – YouTube for which you can download:
- Paper: [Wayback] sec16_paper_wheeler.pdf
- Slides: [Wayback] security16_slides_wheeler.pdf
Via:
- [Wayback/Archive] Why is there a passwords.txt file on my system that’s filled with somebody else’s passwords? – The Old New Thing
- [Wayback/Archive] dropbox/zxcvbn: Low-Budget Password Strength Estimation
- [Wayback/Archive] zxcvbn: realistic password strength estimation – Dropbox
–jeroen
The Wiert Corner - irregular stream of stuff 
Thaddy de Koning said
Funny,
Just this morning I did a FreePascal/Delphi implementation for it!
jpluimers said
How cool is that!
(and thanks; where is the implementation?)