Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there any way to check a list of passwords whether they strong or not?

I have a list of passwords, around 2000, and want to check them against this policy

  • Password must contain a minimum of eight (8) characters
  • Password must contain at least one letter
  • Password must contain at least one number
  • Password must contain at least one punctuation character

And count how many compliant with that policy before we save them.

Is there any tool, script or maybe rules in excel to do this instead of doing it manually?

Could you please help me?

share|improve this question

closed as off topic by mdpc, Zoredache, joeqwerty, EEAA, Magellan Nov 10 '12 at 0:19

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You tag this JavaScript and excel; I'm wondering why? They seem to be an odd combination... –  Mark Henderson Nov 8 '12 at 22:04
    
What the heck are you doing with 2000 plain text passwords saved? These aren't for active accounts on some system are they? –  Zoredache Nov 8 '12 at 22:16
    
These passwords are belong to project in my school to check the passwords before we encrypt them and save them in secure environment. –  user144705 Nov 8 '12 at 22:27
3  
Once you have passwords in plaintext, they're not secure. So, you may as well discard all the passwords now and use... well, any modern operating system or authentication scheme that will check password policies for you, before accepting the a password. –  HopelessN00b Nov 8 '12 at 22:43
    
Discard the passwords will not solve this as the system used for input the password is very old and it not checking the password policies before accept them. –  user144705 Nov 8 '12 at 22:57

2 Answers 2

Relevant xkcd comic is relevant.

xkcd

And in any event, once you have passwords in plaintext, they're not secure. So, you may as well discard all the passwords now and use any modern operating system or authentication scheme that will check passwords against a password policy for you, before accepting the password.

Because really, why not just hold onto the list of what everyone's password is and be able to login as anyone?

share|improve this answer

With a policy so well defined it is trivial to write a script in almost any language (or you can even use shell utilities). I.e. for each password, you can:

  • min of 8 characters: [[ $(echo -n "$password" | wc -c) >= 8 ]] || echo "Too short"
  • contains a letter: echo "$password" | grep -iq '[a-z]' || echo "No letters"
  • contains a number: echo "$password" | grep -q '[0-9]' || echo "No digits"
  • contains punctuation: echo "$password" | grep -iq '[^a-z0-9]' || echo "No punctuation"

Another way of checking passwords for strength is with cracklib. I don't know how you can define its policies there but it does serve a purpose. E.g.

$ cat list-of-passwords | cracklib-check
password: it is based on a dictionary word
passw0rd: it is based on a dictionary word
Passw0rd!: it is based on a dictionary word
Tr0ub4dor&3: OK
correct horse battery staple: OK
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.