TYPO3 Core

https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler contains great explanation on how to measure password strength and why for instance the NIST approach is not accurate (around minute 16:00+ in the video).

That approach includes weak word lists (which would have to be adjusted by use for different languages if it comes to names and umlaut characters) as well as keyboard maps (which would have to be extended as well for a bunch of European layouts) - if not adjusted, results probably are still accurate (but could be better of course). For instance we might to add joh316 to those lists.

Given that training data might become big (~ 1 MB for the JavaScript part), using a server-side API approach (custom controller) might solve it and avoids cluttering the JavaScript client space.

JavaScript Implementation (Coffee Script, but transformable to TypeScript)¶

https://github.com/dropbox/zxcvbn
https://github.com/dropbox/zxcvbn/tree/master/data-scripts (generators for training data)

PHP Implementation¶

https://github.com/bjeavons/zxcvbn-php
https://github.com/bjeavons/zxcvbn-php/tree/master/data-scripts (generators for training data)

Scoring¶

Demo: https://lowe.github.io/tryzxcvbn/

Example

const result = zxcvbn(password);
if (result.guesses < 1000) {
  // too weak
}
if (result.score < 2) { // range from 0-4
  // too weak
}