Package: passwordmeter
A configurable, extensible password strength measuring library.ProjectHomepage:https://github.com/cadithealth/passwordmeterBugs:https://github.com/cadithealth/passwordmeter/issuesTL;DRInstall:$pipinstallpasswordmeterUse from within an application with the default factors:importpasswordmeterstrength,improvements=passwordmeter.test(sys.argv[1])ifstrength<0.5:print'Your password is too weak.'Use on the command line:$pwm'password'Passwordstrength:0.132549901057(Extremelyweak)Possibleimprovements:-Useagoodmixofnumbers,letters,andsymbols-Avoidusingoneofthetenthousandmostcommonpasswords-UseagoodmixofUPPERcaseandlowercaselettersOverviewThe main function provided by thepasswordmeterpackage is theMeter.test()method, which returns a tuple of (float, dict). The
float is the strength of the password in the range 0 to 1 (inclusive),
where 0 is extremely weak and 1 is extremely strong. The second
parameter, which may beNone, is a dictionary of ways the password
could be improved. The keys of the dict are general “categories” of
ways to improve the password (e.g. “length”) that are fixed strings,
and the values are internationalizable strings that are human-friendly
descriptions and possibly tailored to the specific password.A password’s strength is determined by doing a weighted, skewed,
curved average of a set of “factors”. TheMeterconstructor takes asettingsdictionary that configures, customizes, and/or supplements
the default set of factors.Thepasswordmeter.testis a helper function that simply uses the
default settings to test the strength of a password, and is
effectively a shorthand forMeter().test(...).For example, to use a custom selection of factors:importpasswordmeter# use only the 'length' and 'charmix' factorsmeter=passwordmeter.Meter(settings=dict(factors='length,charmix'))strength,improvements=meter.test('s3cr3t p4ssW0RD!')SettingsThesettingsattribute to theMeterconstructor is a dictionary
with the following keys:factors:This is a comma-separated list of factors to use in calculating the
strength of a password. Each element in the list is either the name
of a known factor or a symbol-spec as defined by theasset module. Seepasswordmeter.DEFAULT_FACTORSfor the default list of factors
(and their names).For example, to use only the ‘length’ factor and a custom factor:importpasswordmeterclassSillyFactor(passwordmeter.Factor):category='silly'deftest(self,value,extra):ifvalue=='silly':return(0,'That is a silly password!')return(1,None)meter=passwordmeter.Meter(settings=dict(factors=['length',SillyFactor]))# or, same thing, but using an asset-spec:meter=passwordmeter.Meter(settings=dict(factors='length,mypackage.SillyFactor'))factor.{NAME}.{ATTRIBUTE}:Set a factor’s attribute during initialization. If a setting in the
formfactor.{NAME}.classis specified for a factor not listed in
thefactorssetting, the factor will be auto-added to the list of
factors. This is the preferred mechanism to add a custom factor to
the default list.The following attributes are “special” (all are optional):AttributeInterpretationfactor.{NAME}.classSpecifies the asset-spec for the factory that
can generate a Factor of this type.factor.{NAME}.weightSpecifies the relative weight of this factor
(default: 1).factor.{NAME}.skewAdds the specified amount to factor score
(default: 0).factor.{NAME}.spreadMultiplies the factor score by the specified
amount – similar toweight, but is applied
before clipping (default: 1).factor.{NAME}.clipminForce a minimum score for this factor
(default: 0).factor.{NAME}.clipmaxForce a maximum score for this factor
(default: 1.3).factor.{NAME}.categoryOverride the default improvement category.The following example settings in an INI file will give thelengthfactor additional weight as well as adding the “mypkg.MyFactor”
custom factor (initialized with the parametermsgset to'abort') to the meter’s list:factor.length.weight=2.5factor.cust.class=mypkg.MyFactorfactor.cust.msg=abortpessimism:The password strength engine weights low scores higher than high
scores. The degree to which the engine weights low scores is set by
thepessimismsetting, which defaults to 10 – the higher, the
more a low score will pull the average score down. For example, with
the default pessimism of 10, the two scores 0.75 and 0.25 will be
averaged to 0.4 (instead of the true average of 0.5).threshold:Specifies the maximum score for which improvement messages should be
returned. If not specified, all possible improvements will be
returned, even if the relevant factor returned a perfect score (1.0
or greater).Custom FactorsA custom factor should subclasspasswordmeter.Factor, implement thetestmethod, and have a uniquecategory(string) attribute.Thetestmethod takes two parameters: thevalueto be tested, and
an opaqueextraparameter that is supplied by the calling
application (and can be ignored if not needed). It should return a
tuple of (float, str).The first element (float) of the return tuple must be greater or equal
to zero. Although it should generally not be greater than 1.0, a
factormayreturn a greater value: this is used to artificially
boost the strength of the total outcome relative to the other factors
if applicable. Note, however, that the Meter class will always clip
the final outcome to the inclusive range [0, 1].The second element of the return tuple should be a string, which is a
description of how to improve the provided password. This string can
beNoneif no known way exists to improve this password for this
specific factor. Note that Meter class will associate this description
with the factor’s category in the final outcome.