edoardottt / pwdsafety

🔒command line tool checking password safety🔒

Command line tool that checks how much a password is safe
_{Coded with 💙 by edoardottt.}

Get Started • Description • Scoring • Contributing • Changelog

This tool doesn't store any information!
Never use personal information in your password!

• Use a password manager (I recommend bitwarden)
• Don't use the same password for different services
• Enable 2FA wherever possible

Get Started 🎉

Snap

sudo snap install pwdsafety

Go1.17+

go install -v github.com/edoardottt/pwdsafety@latest

From source

• First of all, clone the repo locally

  • git clone https://github.com/edoardottt/pwdsafety.git

• pwdsafety has external dependencies, so they need to be pulled in:

  • cd pwdsafety/cmd && go get && cd ..

• Linux (Requires high perms, run with sudo)

  • make linux (to install)

  • make unlinux (to uninstall)

• Windows (executable works only in pwdsafety folder. Alias?)

  • make windows (to install)

  • make unwindows (to uninstall)

Description 🔦

It reads from standard input the entered password.
First, it searches if the password or the password reversed is a well known pwd.
Then, just do little calculations, checking if the basic rules are respected, like if there are UPPERCASE CHARS, lowercase chars, numb3rs and symbols.
It stores the length of the password and the ratio [unique different chars / total chars].
It calculates then the entropy of a password.
Password entropy is a measurement of how unpredictable a password is.
The formula for entropy is:

Where:

• E = password entropy
• R = pool of unique characters
• L = number of characters in your password
• Then R^L = the number of possible passwords

When the score <= 68(reasonable) it generates a random password.

Scoring 💯

Max score: 100

Scores:

• Very weak: 0 - 35
• Weak: 36 - 59
• Reasonable: 60 - 68
• Strong: 69 - 80
• Very strong: 81 -100

Scoring parameters:

• Found in known password
• Found in known password reversed
• Password composition:
  • numbers
  • symbols
  • uppercase
  • lowercase
• Unique different characters
• Length
• Entropy

Contributing 🛠

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

See also CONTRIBUTING.md and CODE OF CONDUCT.md

Thanks to fabaff and ecnepsnai.

Changelog 📌

Detailed changes for each release are documented in the release notes.

License 📝

This repository is under GNU General Public License v3.0.
edoardoottavianelli.it to contact me.

pwdsafety's Issues

Use zxcvbn (or its newer variants) instead of the plain entropy formula

Is your feature request related to a problem? Please describe.
I'm always frustrated when I see people believing plain entropy mantra.

Describe the solution you'd like
Exchange the entropy formula for https://github.com/dropbox/zxcvbn or a newer variant of zxcvbn.

Describe alternatives you've considered
Leaving users to believe in a pure mathematical world where only entropy matters.

Additional context
Related:
#18
#15

Change pwd length score

. auto explain

Correct min-entropy formula

Symbols Error

When I read the symbols, my program doesn't read well the symbols...

You can find a better explanation of what i trying to say running go test -v
So, in the tests I use 10 characters, but the result's length is 11.

The issue is in Utils/Basic-rules.go/GenerateSetString()

Remove engWordsList.txt

There's no need to have a 50000+ english words in a f*cking txt file.
Just give random pwd with 40+ chars.