bjeavons/zxcvbn-php

zxcvbn-php is a PHP port of Dropbox’s zxcvbn password strength estimator. Instead of enforcing simplistic rules like a minimum length or required symbols, it evaluates how resistant a password actually is by pattern-matching against common passwords, names, dictionary words, dates, repeats, sequences, and keyboard patterns, then estimating the entropy of what remains.

It returns a rich analysis including a 0-4 strength score, estimated crack times under different attack scenarios, the matched patterns it found, and actionable feedback with warnings and suggestions, making it well suited for giving users meaningful, realistic guidance while they choose a password.

What You Get

• A 0-4 password strength score based on realistic attack modeling
• Estimated crack times across several attack scenarios
• Pattern matching against common passwords, names, words, dates, and sequences
• Actionable feedback with warnings and improvement suggestions
• Support for user-supplied dictionaries (e.g. the user’s name or email)

Common Use Cases

• Scoring password strength during account signup or password change
• Showing users a live strength meter with meaningful feedback
• Rejecting weak passwords that pass naive length/complexity rules
• Auditing existing passwords against common-pattern weaknesses

Under The Hood

Architecture — The entry point is the Zxcvbn class (src/Zxcvbn.php), which coordinates a Matcher pipeline and a Scorer. Matcher (src/Matcher.php) runs a set of pluggable matchers under src/Matchers (dictionary, spatial/keyboard, repeat, sequence, date, l33t, and more), each of which reports the patterns it finds in the candidate password. The Scorer (src/Scorer.php) computes the minimum-entropy path through those matches, a Math helper provides the combinatorics, TimeEstimator translates entropy into crack-time estimates, and Feedback (src/Feedback.php) turns the weakest match into warnings and suggestions. Tech Stack — Pure PHP supporting 7.2 through 8.x, depending only on symfony/polyfill-mbstring and ext-json, with bundled frequency dictionaries as data. Code Quality — The library is well-structured with clear separation between matching, scoring, and feedback, and historically carried test coverage and CI (PHPUnit, Coveralls); it is mature and stable but currently inactive, meaning it is feature-complete rather than actively evolving. API Design — The public API is deliberately tiny: instantiate Zxcvbn and call passwordStrength($password, $userInputs) to get a structured array of score, entropy, crack times, matched sequences, and feedback. This mirrors the original JS library closely, making it easy to adopt and to reason about for anyone familiar with zxcvbn.