-4

Is there any way to check a list of passwords whether they strong or not?

I have a list of passwords, around 2000, and want to check them against this policy

  • Password must contain a minimum of eight (8) characters
  • Password must contain at least one letter
  • Password must contain at least one number
  • Password must contain at least one punctuation character

And count how many compliant with that policy before we save them.

Is there any tool, script or maybe rules in excel to do this instead of doing it manually?

Could you please help me?

5
  • You tag this JavaScript and excel; I'm wondering why? They seem to be an odd combination... Nov 8, 2012 at 22:04
  • What the heck are you doing with 2000 plain text passwords saved? These aren't for active accounts on some system are they?
    – Zoredache
    Nov 8, 2012 at 22:16
  • These passwords are belong to project in my school to check the passwords before we encrypt them and save them in secure environment.
    – user144705
    Nov 8, 2012 at 22:27
  • 3
    Once you have passwords in plaintext, they're not secure. So, you may as well discard all the passwords now and use... well, any modern operating system or authentication scheme that will check password policies for you, before accepting the a password. Nov 8, 2012 at 22:43
  • Discard the passwords will not solve this as the system used for input the password is very old and it not checking the password policies before accept them.
    – user144705
    Nov 8, 2012 at 22:57

2 Answers 2

3

Relevant xkcd comic is relevant.

xkcd

And in any event, once you have passwords in plaintext, they're not secure. So, you may as well discard all the passwords now and use any modern operating system or authentication scheme that will check passwords against a password policy for you, before accepting the password.

Because really, why not just hold onto the list of what everyone's password is and be able to login as anyone?

3

With a policy so well defined it is trivial to write a script in almost any language (or you can even use shell utilities). I.e. for each password, you can:

  • min of 8 characters: [[ $(echo -n "$password" | wc -c) >= 8 ]] || echo "Too short"
  • contains a letter: echo "$password" | grep -iq '[a-z]' || echo "No letters"
  • contains a number: echo "$password" | grep -q '[0-9]' || echo "No digits"
  • contains punctuation: echo "$password" | grep -iq '[^a-z0-9]' || echo "No punctuation"

Another way of checking passwords for strength is with cracklib. I don't know how you can define its policies there but it does serve a purpose. E.g.

$ cat list-of-passwords | cracklib-check
password: it is based on a dictionary word
passw0rd: it is based on a dictionary word
Passw0rd!: it is based on a dictionary word
Tr0ub4dor&3: OK
correct horse battery staple: OK

Not the answer you're looking for? Browse other questions tagged .