# dropbox/zxcvbn

Low-Budget Password Strength Estimation

Repository: https://github.com/dropbox/zxcvbn
Canonical: https://ross.abutalabs.com/products/zxcvbn
Homepage: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
Language: CoffeeScript
License: MIT
License Family: permissive
Last push: 2024-08-19T09:54:34+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 5300, "days_push": 744, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 16037, forks 996 (observed 2026-08-28T04:11:14.703043+00:00)

## What it is
zxcvbn is a JavaScript password strength estimator inspired by password crackers, using pattern matching and conservative estimation against common passwords, words, dates, keyboard patterns, and l33t speak. It provides realistic guessability scores plus targeted verbal feedback as an alternative to rigid password composition rules.

## Use cases
- estimate password strength realistically in a signup form
- replace password composition rules with a complexity score
- give users instant feedback on weak passwords
- detect common passwords and keyboard patterns like qwerty
- score passphrase strength based on word rarity

## When to choose
- you need client-side password strength metering with no server round-trip
- you want to replace LUDS composition policies with a research-backed estimator

## When to avoid
- you need server-side strength checks in a non-JavaScript stack without a port
- you need cryptographic key-strength validation rather than user-facing feedback

## Facets
- artifact type: library
- maturity: maintenance
- function: security, auth
- domain: security, web-development
- platform: browser, cross-platform
- tags: password-strength, entropy-estimation, coffeescript, nodejs

## Member repositories
- dropbox/zxcvbn (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:14.703043+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:05:16.514968+00:00, confidence not recorded.
  - readme: https://github.com/dropbox/zxcvbn (fetched 2026-08-28T04:11:14.703043+00:00, sha 08f0e2c647ee)
  - homepage: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler (fetched 2026-08-29T08:03:22.387252+00:00, sha 6c9afd83b807)
  - registry_npm: https://registry.npmjs.org/zxcvbn (fetched 2026-08-29T08:03:22.391782+00:00, sha dac7580b9dd1)
  - site_page: https://www.usenix.org/conference/usenixsecurity16/symposium-organizers (fetched 2026-08-29T08:03:22.389848+00:00, sha 916468c9b120)
- Data as of 2026-08-30T08:39:29.467469+00:00.