Search code examples
passwordspassword-checker

Guidelines for a Password Strength Meter (Password checker) Design

I have tried different types of Password Strength Meters or Password checkers, but all give me different results when I test the same Password, because each implements its own algorithm.

Is there some official standard or guideline that can follow me to build my own Password Strength Meter.

If there was no official standard, what features should a good Password Strength Meter check for?

Solution

  • Consider the following:

    • Length
    • Mixed case
    • Not many repeated characters
    • Includes letters, numbers, and symbols
    • Does not include part of the username
    • Not similar to prior passwords
    • Does not hash to the same thing as a weak password
    • Is not a keyboard walk
    • Is not related to the individual
    • Does not end with the common suffixes
    • Does not start with the common prefixes

    See Bruce Schneier's post on passwords as well as this post.