A Java library for advanced password strength estimation, inspired by zxcvbn, with internationalization and custom dictionaries.
Nbvcxz is a Java-based password strength estimation library that analyzes passwords using multiple algorithms to detect patterns like dictionary words, dates, spatial sequences, and repeats. It calculates entropy to estimate real-world crackability, helping developers implement robust password validation without relying on arbitrary complexity rules. The project includes a standalone console tool and a library for integration into Java applications.
Java developers building secure authentication systems, backend engineers needing password validation, and security-conscious teams looking to replace simplistic password policies with intelligent strength estimation.
Developers choose Nbvcxz for its accuracy in modeling modern password attacks, extensive customization options, and internationalization support. It improves upon zxcvbn with better match algorithms, configurable dictionaries, and localized feedback, making it a versatile drop-in solution for enterprise-grade security.
Password strength estimator
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses multiple algorithms to match dictionary words with fuzzy Levenshtein distance, dates, spatial patterns, and sequences, modeling real attacker behavior as described in the Differentiating Features section.
Supports localized feedback in 15+ languages including English, French, German, and Chinese, making it suitable for global applications without extra translation work.
Allows easy addition of custom dictionaries and exclusion lists, such as per-user banned words like names or emails, via the ConfigurationBuilder as shown in the Custom Configuration example.
Implements an algorithm that finds the absolute lowest entropy combination of matches, leading to more accurate strength estimation than older methods, as highlighted in the Differentiating Features.
Includes a Generator class to create secure random passwords or passphrases, useful for temporary access or resets, demonstrated in the Generate Passphrase/Password section.
Limited to Java environments (requires Java 1.7+), making it unsuitable for projects in other languages like Python, Node.js, or frontend JavaScript without additional integration layers.
The ConfigurationBuilder offers numerous options for dictionaries, matchers, and thresholds, which can be overwhelming for developers seeking a simple, drop-in solution without fine-tuning.
By default, it produces different results than zxcvbn due to features like Levenshtein distance and improved algorithms, requiring manual configuration adjustments for compatibility as admitted in the Compatibility section.
The advanced matching algorithms and entropy calculation, while accurate, may introduce more computational overhead compared to basic rule-based validators, though not explicitly benchmarked in the README.