Nbvcxz
A Java library for advanced password strength estimation, inspired by zxcvbn, with internationalization and custom dictionaries.
What is Nbvcxz?
Nbvcxz is a Java-based password strength estimation library that analyzes passwords using multiple algorithms to detect patterns like dictionary words, dates, spatial sequences, and repeats. It calculates entropy to estimate real-world crackability, helping developers implement robust password validation without relying on arbitrary complexity rules. The project includes a standalone console tool and a library for integration into Java applications.
Java developers building secure authentication systems, backend engineers needing password validation, and security-conscious teams looking to replace simplistic password policies with intelligent strength estimation.
Developers choose Nbvcxz for its accuracy in modeling modern password attacks, extensive customization options, and internationalization support. It improves upon zxcvbn with better match algorithms, configurable dictionaries, and localized feedback, making it a versatile drop-in solution for enterprise-grade security.
Overview
Password strength estimator
Use Cases
Best For
- Validating password strength in Java web applications
- Replacing arbitrary password policies with entropy-based checks
- Adding multilingual feedback for international user bases
- Generating secure temporary passwords for password resets
- Integrating custom dictionary checks (e.g., banning user-specific words)
- Educational tools demonstrating password vulnerability to users
Not Ideal For
- Projects not using Java or JVM languages
- Client-side web applications requiring real-time JavaScript validation
- Systems needing strict compatibility with zxcvbn without configuration tweaks
- Environments where ultra-fast, lightweight password checks are prioritized over accuracy
Pros & Cons
Pros
Uses multiple algorithms to match dictionary words with fuzzy Levenshtein distance, dates, spatial patterns, and sequences, modeling real attacker behavior as described in the Differentiating Features section.
Supports localized feedback in 15+ languages including English, French, German, and Chinese, making it suitable for global applications without extra translation work.
Allows easy addition of custom dictionaries and exclusion lists, such as per-user banned words like names or emails, via the ConfigurationBuilder as shown in the Custom Configuration example.
Implements an algorithm that finds the absolute lowest entropy combination of matches, leading to more accurate strength estimation than older methods, as highlighted in the Differentiating Features.
Includes a Generator class to create secure random passwords or passphrases, useful for temporary access or resets, demonstrated in the Generate Passphrase/Password section.
Cons
Limited to Java environments (requires Java 1.7+), making it unsuitable for projects in other languages like Python, Node.js, or frontend JavaScript without additional integration layers.
The ConfigurationBuilder offers numerous options for dictionaries, matchers, and thresholds, which can be overwhelming for developers seeking a simple, drop-in solution without fine-tuning.
By default, it produces different results than zxcvbn due to features like Levenshtein distance and improved algorithms, requiring manual configuration adjustments for compatibility as admitted in the Compatibility section.
The advanced matching algorithms and entropy calculation, while accurate, may introduce more computational overhead compared to basic rule-based validators, though not explicitly benchmarked in the README.
Frequently Asked Questions
Related Projects
TinkTink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
KeywhizA system for distributing and managing secrets
pac4jSecurity engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...
ThemisEasy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.