Changelog

First release.

Added#

• A strength estimate in 8.4 kB gzipped, against zxcvbn's measured 398 kB, on the same 0–4 scale so an existing bar keeps working.
• Matchers for the cases that actually occur: the common-password list, l33t substitution undone before the list is consulted, keyboard runs — including the Arabic layout, plus AZERTY and QWERTZ — sequences, repeats, dates, years, and anything the person has already told you about themselves.
• No credit for character classes. P@ssw0rd1 scores 0 and correct horse battery staple scores 4.
• Translated advice in English, Arabic and Urdu, with reason codes rather than sentences so it can be translated, logged or acted on. A test checks every pack is complete.
• An optional breach check by k-anonymity: the SHA-1 is taken locally and only its first five characters are sent. A match drops the score to nothing; a service that is down is ignored rather than allowed to break the form.
• Two crack times, online and offline, because they differ by a million and quoting one of them is misleading.
• A real progressbar with aria-valuetext, and a live region that speaks when the band changes rather than on every keystroke.
• React, Vue, Svelte, <dx-strength-meter> and a CDN build over one core.
• The estimator exported with no DOM in it, for checking on a server as well.