import zxcvbn from "zxcvbn-ts" const result = zxcvbn("correcthorsebatterystaple") console.log(result.score) // 3 (0 = very weak … 4 = very strong) console.log(result.guesses) // ~10^14 console.log(result.feedback) // { // warning: "", // suggestions: ["Add another word or two. Uncommon words are better."] // } console.log(result.crack_times_display.offline_fast_hashing_1e10_per_second) // "centuries"

const result = zxcvbn("alice1990", ["alice", "alice@example.com"]) // guess count is reduced when the password contains user-supplied words

import { zxcvbnAI } from "zxcvbn-ts/ai" const result = await zxcvbnAI("password123") console.log(result.score) // 0 console.log(result.feedback.warning) // "This is a top-10 common password." console.log(result.feedback.suggestions) // ["Use a passphrase instead.", "Add symbols and uncommon words."] console.log(result.feedback.explanation) // "Your password combines one of the most commonly used passwords with a // predictable number suffix. Attackers specifically try these combinations // first. A passphrase of four or more random words would be far more secure."

const result = await zxcvbnAI("password123", { apiKey: "sk-ant-...", })

import { zxcvbnAI } from "zxcvbn-ts/ai" async function validatePassword(password: string, username: string) { const result = await zxcvbnAI(password, {}, [username]) if (result.score < 3) { return { valid: false, message: result.feedback.explanation, // "Your password contains your username and a common word. // Attackers try personal information first. Use a passphrase // with unrelated words instead." } } return { valid: true } }

interface ZxcvbnResult { /** Estimated number of guesses needed to crack the password. */ guesses: number /** log₁₀ of guesses. */ guesses_log10: number /** 0 = very weak, 1 = weak, 2 = fair, 3 = strong, 4 = very strong. */ score: 0 | 1 | 2 | 3 | 4 /** The sequence of match objects that produced the lowest guess estimate. */ sequence: Match[] /** Estimated seconds-to-crack under four attack scenarios. */ crack_times_seconds: CrackTimesSeconds /** Human-readable crack-time strings. */ crack_times_display: CrackTimesDisplay /** Actionable feedback for the user. */ feedback: Feedback /** Time in ms the estimation took. */ calc_time: number }

interface Feedback { warning: string // Empty string if no specific warning. suggestions: string[] } interface AIFeedback extends Feedback { optimization: string // Plain-English explanation of the weakness }

type Match = BruteforceMatch | DictionaryMatch | SpatialMatch | RepeatMatch | SequenceMatch | RegexMatch | DateMatch

for (const m of result.sequence) { if (m.pattern === "dictionary") { console.log(m.matched_word, m.rank, m.dictionary_name) } else if (m.pattern === "spatial") { console.log(m.graph, m.turns, m.shifted_count) } else if (m.pattern === "repeat") { console.log(m.base_token, m.repeat_count) } else if (m.pattern === "date") { console.log(m.year, m.month, m.day) } }

import { omnimatch, dictionaryMatch, reverseDictionaryMatch, l33tMatch, spatialMatch, repeatMatch, sequenceMatch, regexMatch, dateMatch, setUserInputDictionary, mostGuessableMatchSequence, estimateAttackTimes, guessesToScore, displayTime, getFeedback, } from "zxcvbn-ts"