# zxcvbn-ts/zxcvbn

Low-Budget Password Strength Estimation

Repository: https://github.com/zxcvbn-ts/zxcvbn
Canonical: https://ross.abutalabs.com/products/zxcvbn-ts-zxcvbn
Homepage: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
Language: TypeScript
License: MIT
License Family: permissive
Topics: hacktoberfest, password, password-strength
Last push: 2026-08-12T15:55:17+00:00

## Health v2 (maintenance only)
Score: 76/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 97, release rhythm 35, longevity 100
- inputs: {"age_days": 2462, "days_push": 21, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1204, forks 91 (observed 2026-08-28T04:03:58.796793+00:00)

## What it is
A TypeScript rewrite of Dropbox's zxcvbn password strength estimator that scores passwords based on pattern matching against common passwords, dictionary words, keyboard patterns, and other weak patterns. It provides strength scores, verbal feedback, i18n support, and extensible custom matchers.

## Use cases
- estimate password strength in a signup form
- replace LUDS password complexity rules with a smarter score
- give users instant feedback on weak passwords
- check passwords against common leaked password patterns
- add localized password feedback in multiple languages
- add custom dictionary matchers for password checking

## When to choose
- you need client-side password strength estimation in a JavaScript/TypeScript app
- you want an algorithmic alternative to rigid password composition policies
- you need i18n support for password feedback and dictionaries
- you want to extend matching with custom dictionaries or API-based matchers

## When to avoid
- you need server-side password strength checking in a non-JS backend
- you need actual password cracking or entropy auditing rather than estimation
- you cannot ship the dictionary packages due to bundle size constraints

## Facets
- artifact type: library
- maturity: active
- function: security, developer-tools, internationalization
- domain: security, web-development, frontend, developer-tools
- platform: browser, cross-platform
- tags: password-strength, zxcvbn, password-estimation, form-validation, typescript, nodejs

## Member repositories
- zxcvbn-ts/zxcvbn (main) score 76

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:58.796793+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:19:41.604451+00:00, confidence not recorded.
  - readme: https://github.com/zxcvbn-ts/zxcvbn (fetched 2026-08-28T04:03:58.796793+00:00, sha 4d89aeb11968)
  - homepage: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler (fetched 2026-08-29T12:27:39.649384+00:00, sha 6c9afd83b807)
  - site_page: https://www.usenix.org/conference/usenixsecurity16/symposium-organizers (fetched 2026-08-29T12:27:39.658387+00:00, sha 916468c9b120)
- Data as of 2026-08-30T08:39:29.467469+00:00.