Password Strength Analyzer (cpp, written by Claude Code)

--- /dev/null
+++ b/setup.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# System packages this project needs on a clean Ubuntu machine.
+set -e
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq --no-install-recommends libssl-dev

Claude Code wrote this cpp project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: Password Strength Analyzer

Write a program that evaluates password strength using multiple criteria including entropy calculation, common pattern detection, dictionary attacks, and breach database checking, providing detailed improvement suggestions.

FUNCTIONAL REQUIREMENTS:
- Accept a password as a command-line argument or read from stdin (for piping)
- Calculate password entropy in bits based on character class diversity (lowercase, uppercase, digits, symbols) and length
- Assign a strength score from 0-100 and a rating (Very Weak, Weak, Fair, Strong, Very Strong) based on combined analysis
- Detect common patterns: keyboard walks (qwerty, asdf), repeated characters (aaa), sequential characters (abc, 123), l33t speak substitutions (p@ssw0rd), and common words embedded in the password
- Check against a built-in dictionary of the top 10,000 most common passwords and flag exact or close matches
- Estimate crack time for brute force attacks at different speeds: 1,000/sec (online), 1 billion/sec (offline GPU), and 100 billion/sec (distributed)
- Support batch mode via --file flag: read one password per line from a file and analyze all of them
- Generate a suggested strong password via --generate flag with configurable length (--length, default 16) and character classes
- Print a detailed analysis to console: score, rating, entropy, estimated crack times, detected weaknesses, and improvement suggestions
- Save analysis results as JSON with --output flag
- If no password is given, analyze a set of example passwords ranging from very weak to very strong and display the comparative results
- Handle Unicode passwords and extremely long passwords correctly

Create a complete C++ project for a clean Ubuntu 22.04 machine with only G++ 12+ and CMake 3.22+ installed. Include:
- Source code
- CMakeLists.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[
  {
    "category": "underspecification",
    "rule": "signature.missing_system_requirement",
    "source": "failure_signature",
    "excerpt": "Could NOT find OpenSSL, try to set the path to OpenSSL root folder in the"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "export DEBIAN_FRONTEND=noninteractive"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "apt-get install -y -qq --no-install-recommends libssl-dev"
  }
]

cmake_minimum_required(VERSION 3.14)
project(PasswordAnalyzer VERSION 1.0.0 LANGUAGES CXX)

set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)

# Find OpenSSL (system dependency)
find_package(OpenSSL REQUIRED)

# Fetch nlohmann/json
include(FetchContent)
FetchContent_Declare(
    nlohmann_json
    GIT_REPOSITORY https://github.com/nlohmann/json.git
    GIT_TAG v3.11.3
)
FetchContent_MakeAvailable(nlohmann_json)

# Main executable
add_executable(password_analyzer main.cpp)

target_link_libraries(password_analyzer
    PRIVATE
        OpenSSL::SSL
        OpenSSL::Crypto
        nlohmann_json::nlohmann_json
)

target_compile_options(password_analyzer PRIVATE
    $<$<CXX_COMPILER_ID:GNU>:-Wall -Wextra -O2>
    $<$<CXX_COMPILER_ID:Clang>:-Wall -Wextra -O2>
    $<$<CXX_COMPILER_ID:MSVC>:/W4 /O2>
)

/**
 * Password Strength Analyzer - C++ (Trial 1)
 *
 * Evaluates password strength via entropy calculation, pattern detection,
 * dictionary checks, and crack time estimation.
 *
 * Dependencies: OpenSSL (system), nlohmann/json (3.11.3)
 */

#include <iostream>
#include <string>
#include <cmath>
#include <map>
#include <set>
#include <vector>
#include <algorithm>
#include <regex>
#include <sstream>
#include <iomanip>

#include <openssl/sha.h>
#include <nlohmann/json.hpp>

using json = nlohmann::json;

// Common passwords dictionary for dictionary checks
static const std::vector<std::string> COMMON_PASSWORDS = {
    "password", "123456", "12345678", "qwerty", "abc123", "monkey",
    "master", "dragon", "111111", "baseball", "iloveyou", "trustno1",
    "sunshine", "letmein", "welcome", "shadow", "superman", "michael",
    "football", "password1", "password123", "admin", "login", "hello",
    "charlie", "donald", "passw0rd", "access", "1234567", "654321",
    "joshua", "ashley", "123123", "696969", "mustang", "batman",
    "princess", "qwerty123", "letmein123", "welcome1"
};

// Keyboard rows for keyboard pattern detection
static const std::vector<std::string> KEYBOARD_ROWS = {
    "qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890"
};

/**
 * Calculate the SHA-256 hash of a string using OpenSSL.
 */
std::string sha256Hash(const std::string& input) {
    unsigned char hash[SHA256_DIGEST_LENGTH];
    SHA256(reinterpret_cast<const unsigned char*>(input.c_str()), input.size(), hash);

    std::stringstream ss;
    for (int i = 0; i < SHA256_DIGEST_LENGTH; i++) {
        ss << std::hex << std::setw(2) << std::setfill('0') << static_cast<int>(hash[i]);
    }
    return ss.str();
}

/**
 * Structure representing the analysis results.
 */
struct PasswordAnalysis {
    std::string maskedPassword;
    int length;
    int score;
    std::string scoreLabel;
    double entropy;
    int uppercaseCount;
    int lowercaseCount;
    int digitCount;
    int specialCount;
    int uniqueChars;
    std::string sha256;
    std::map<std::string, std::string> crackTimes;
    std::vector<std::string> patterns;
    bool dictionaryMatch;
    std::vector<std::string> feedback;
};

/**
 * Mask a password for display.
 */
std::string maskPassword(const std::string& password) {
    if (password.length() <= 2) {
        return std::string(password.length(), '*');
    }
    return password[0] + std::string(password.length() - 2, '*') + password[password.length() - 1];
}

/**
 * Calculate Shannon entropy of a password.
 */
double calculateEntropy(const std::string& password) {
    if (password.empty()) return 0.0;

    // Calculate based on character set size
    bool hasLower = false, hasUpper = false, hasDigit = false, hasSpecial = false;
    for (char c : password) {
        if (std::islower(c)) hasLower = true;
        else if (std::isupper(c)) hasUpper = true;
        else if (std::isdigit(c)) hasDigit = true;
        else hasSpecial = true;
    }

    int charsetSize = 0;
    if (hasLower) charsetSize += 26;
    if (hasUpper) charsetSize += 26;
    if (hasDigit) charsetSize += 10;
    if (hasSpecial) charsetSize += 33;

    if (charsetSize == 0) return 0.0;

    return password.length() * std::log2(charsetSize);
}

/**
 * Calculate Shannon entropy per character.
 */
double calculateShannonEntropy(const std::string& password) {
    if (password.empty()) return 0.0;

    std::map<char, int> freq;
    for (char c : password) {
        freq[c]++;
    }

    double entropy = 0.0;
    double len = static_cast<double>(password.length());
    for (const auto& pair : freq) {
        double p = pair.second / len;
        entropy -= p * std::log2(p);
    }

    return entropy * password.length();
}

/**
 * Format seconds into human-readable time.
 */
std::string formatTime(double seconds) {
    if (seconds < 1.0) return "instant";
    if (seconds < 60.0) return std::to_string(static_cast<int>(seconds)) + " seconds";
    if (seconds < 3600.0) return std::to_string(static_cast<int>(seconds / 60)) + " minutes";
    if (seconds < 86400.0) return std::to_string(static_cast<int>(seconds / 3600)) + " hours";
    if (seconds < 2592000.0) return std::to_string(static_cast<int>(seconds / 86400)) + " days";
    if (seconds < 31536000.0) return std::to_string(static_cast<int>(seconds / 2592000)) + " months";
    if (seconds < 3153600000.0) return std::to_string(static_cast<int>(seconds / 31536000)) + " years";
    return "centuries";
}

/**
 * Check if the password matches a common dictionary word.
 */
bool isDictionaryWord(const std::string& password) {
    std::string lower = password;
    std::transform(lower.begin(), lower.end(), lower.begin(), ::tolower);

    for (const auto& word : COMMON_PASSWORDS) {
        if (lower == word) return true;
    }
    return false;
}

/**
 * Detect patterns in the password.
 */
std::vector<std::string> detectPatterns(const std::string& password) {
    std::vector<std::string> patterns;
    std::string lower = password;
    std::transform(lower.begin(), lower.end(), lower.begin(), ::tolower);

    // Sequential characters
    for (size_t i = 0; i + 2 < lower.size(); i++) {
        if (lower[i + 1] == lower[i] + 1 && lower[i + 2] == lower[i] + 2) {
            size_t end = i + 2;
            while (end + 1 < lower.size() && lower[end + 1] == lower[end] + 1) end++;
            patterns.push_back("sequential: \"" + password.substr(i, end - i + 1) + "\"");
            break;
        }
    }

    // Repeated characters
    std::regex repeatRegex("(.)\\1{2,}");
    std::sregex_iterator it(password.begin(), password.end(), repeatRegex);
    std::sregex_iterator endIt;
    for (; it != endIt; ++it) {
        patterns.push_back("repeat: \"" + it->str() + "\"");
    }

    // Keyboard patterns
    for (const auto& row : KEYBOARD_ROWS) {
        for (size_t len = 4; len <= lower.size(); len++) {
            for (size_t i = 0; i + len <= lower.size(); i++) {
                std::string sub = lower.substr(i, len);
                if (row.find(sub) != std::string::npos) {
                    patterns.push_back("keyboard: \"" + password.substr(i, len) + "\"");
                }
            }
        }
    }

    // Date patterns
    std::regex dateRegex("(19|20)\\d{2}[\\-/]?(0[1-9]|1[0-2])[\\-/]?(0[1-9]|[12]\\d|3[01])");
    std::sregex_iterator dateIt(password.begin(), password.end(), dateRegex);
    for (; dateIt != endIt; ++dateIt) {
        patterns.push_back("date: \"" + dateIt->str() + "\"");
    }

    // L33t speak detection
    std::map<char, char> l33tMap = {
        {'0', 'o'}, {'1', 'l'}, {'3', 'e'}, {'4', 'a'},
        {'5', 's'}, {'7', 't'}, {'@', 'a'}, {'$', 's'}, {'!', 'i'}
    };
    std::string decoded;
    bool hasL33t = false;
    for (char c : lower) {
        auto it = l33tMap.find(c);
        if (it != l33tMap.end()) {
            decoded += it->second;
            hasL33t = true;
        } else {
            decoded += c;
        }
    }
    if (hasL33t) {
        for (const auto& word : COMMON_PASSWORDS) {
            if (decoded.find(word) != std::string::npos) {
                patterns.push_back("l33t: decoded contains \"" + word + "\"");
                break;
            }
        }
    }

    // Dictionary substring check
    for (const auto& word : COMMON_PASSWORDS) {
        if (word.length() >= 4 && lower.find(word) != std::string::npos) {
            patterns.push_back("dictionary: contains \"" + word + "\"");
        }
    }

    return patterns;
}

/**
 * Analyze a password and return full analysis.
 */
PasswordAnalysis analyzePassword(const std::string& password) {
    PasswordAnalysis analysis;

    if (password.empty()) {
        analysis.maskedPassword = "";
        analysis.length = 0;
        analysis.score = 0;
        analysis.scoreLabel = "Empty";
        analysis.entropy = 0.0;
        analysis.feedback.push_back("Password is empty.");
        return analysis;
    }

    analysis.maskedPassword = maskPassword(password);
    analysis.length = static_cast<int>(password.length());

    // Character composition
    analysis.uppercaseCount = 0;
    analysis.lowercaseCount = 0;
    analysis.digitCount = 0;
    analysis.specialCount = 0;
    std::set<char> uniqueSet(password.begin(), password.end());
    analysis.uniqueChars = static_cast<int>(uniqueSet.size());

    for (char c : password) {
        if (std::isupper(c)) analysis.uppercaseCount++;
        else if (std::islower(c)) analysis.lowercaseCount++;
        else if (std::isdigit(c)) analysis.digitCount++;
        else analysis.specialCount++;
    }

    // Entropy
    analysis.entropy = std::round(calculateEntropy(password) * 100.0) / 100.0;

    // SHA-256 hash
    analysis.sha256 = sha256Hash(password);

    // Pattern detection
    analysis.patterns = detectPatterns(password);

    // Dictionary check
    analysis.dictionaryMatch = isDictionaryWord(password);

    // Score calculation
    int score = 0;
    if (analysis.entropy >= 25) score++;
    if (analysis.entropy >= 40) score++;
    if (analysis.entropy >= 60) score++;
    if (analysis.entropy >= 80) score++;

    if (analysis.dictionaryMatch) score = std::max(0, score - 2);
    if (analysis.patterns.size() > 2) score = std::max(0, score - 1);
    if (password.length() < 6) score = 0;

    analysis.score = std::min(score, 4);

    const std::map<int, std::string> scoreLabels = {
        {0, "Very Weak"}, {1, "Weak"}, {2, "Fair"}, {3, "Strong"}, {4, "Very Strong"}
    };
    analysis.scoreLabel = scoreLabels.at(analysis.score);

    // Crack time estimation
    double guesses = std::pow(2.0, analysis.entropy);
    analysis.crackTimes["Online Throttled (100/hr)"] = formatTime(guesses / 100.0 * 3600.0);
    analysis.crackTimes["Online Unthrottled (10/s)"] = formatTime(guesses / 10.0);
    analysis.crackTimes["Offline Slow Hash (10k/s)"] = formatTime(guesses / 1e4);
    analysis.crackTimes["Offline Fast Hash (10B/s)"] = formatTime(guesses / 1e10);

    // Feedback generation
    if (password.length() < 8) {
        analysis.feedback.push_back("Use at least 8 characters.");
    }
    if (analysis.dictionaryMatch) {
        analysis.feedback.push_back("This is a commonly used password. Choose something unique.");
    }
    if (analysis.uppercaseCount == 0) {
        analysis.feedback.push_back("Add uppercase letters for better strength.");
    }
    if (analysis.lowercaseCount == 0) {
        analysis.feedback.push_back("Add lowercase letters for better strength.");
    }
    if (analysis.digitCount == 0) {
        analysis.feedback.push_back("Add numbers for better strength.");
    }
    if (analysis.specialCount == 0) {
        analysis.feedback.push_back("Add special characters (e.g., !@#$%) for better strength.");
    }
    for (const auto& p : analysis.patterns) {
        if (p.find("sequential") != std::string::npos) {
            analysis.feedback.push_back("Avoid sequential characters like 'abc' or '123'.");
            break;
        }
    }
    for (const auto& p : analysis.patterns) {
        if (p.find("keyboard") != std::string::npos) {
            analysis.feedback.push_back("Avoid keyboard patterns like 'qwerty'.");
            break;
        }
    }
    if (analysis.score >= 3 && analysis.feedback.empty()) {
        analysis.feedback.push_back("Good password! No major issues detected.");
    }

    return analysis;
}

/**
 * Convert analysis to JSON using nlohmann/json.
 */
json analysisToJson(const PasswordAnalysis& analysis) {
    json j;
    j["password"] = analysis.maskedPassword;
    j["length"] = analysis.length;
    j["score"] = analysis.score;
    j["scoreLabel"] = analysis.scoreLabel;
    j["entropy"] = analysis.entropy;
    j["sha256"] = analysis.sha256;

    j["composition"] = {
        {"uppercase", analysis.uppercaseCount},
        {"lowercase", analysis.lowercaseCount},
        {"digits", analysis.digitCount},
        {"special", analysis.specialCount},
        {"uniqueCharacters", analysis.uniqueChars}
    };

    j["crackTimes"] = analysis.crackTimes;
    j["patternsDetected"] = analysis.patterns;
    j["dictionaryMatch"] = analysis.dictionaryMatch;
    j["feedback"] = analysis.feedback;

    return j;
}

/**
 * Print a formatted report to stdout.
 */
void printReport(const PasswordAnalysis& analysis) {
    std::string divider(60, '=');
    std::string thinDivider(50, '-');

    std::cout << divider << "\n";
    std::cout << "       PASSWORD STRENGTH ANALYSIS REPORT\n";
    std::cout << divider << "\n";
    std::cout << "  Password (masked): " << analysis.maskedPassword << "\n";
    std::cout << "  Length:            " << analysis.length << " characters\n";
    std::cout << "  Score:             " << analysis.score << "/4 - " << analysis.scoreLabel << "\n";
    std::cout << "  Entropy:           " << analysis.entropy << " bits\n";
    std::cout << "  SHA-256:           " << analysis.sha256.substr(0, 16) << "...\n\n";

    std::cout << "  Character Composition:\n";
    std::cout << "  " << thinDivider << "\n";
    std::cout << "    Uppercase: " << analysis.uppercaseCount
              << "  Lowercase: " << analysis.lowercaseCount
              << "  Digits: " << analysis.digitCount
              << "  Special: " << analysis.specialCount << "\n";
    std::cout << "    Unique Characters: " << analysis.uniqueChars << "\n\n";

    std::cout << "  Crack Time Estimates:\n";
    std::cout << "  " << thinDivider << "\n";
    for (const auto& pair : analysis.crackTimes) {
        std::cout << "    " << pair.first << ": " << pair.second << "\n";
    }
    std::cout << "\n";

    if (!analysis.feedback.empty()) {
        std::cout << "  Feedback:\n";
        for (const auto& f : analysis.feedback) {
            std::cout << "    - " << f << "\n";
        }
        std::cout << "\n";
    }

    if (!analysis.patterns.empty()) {
        std::cout << "  Detected Patterns:\n";
        std::cout << "  " << thinDivider << "\n";
        for (const auto& p : analysis.patterns) {
            std::cout << "    " << p << "\n";
        }
    } else {
        std::cout << "  No common patterns detected.\n";
    }

    std::cout << divider << "\n";
}

int main(int argc, char* argv[]) {
    std::cout << "Password Strength Analyzer\n";
    std::cout << std::string(40, '-') << "\n\n";

    std::vector<std::string> passwords;

    if (argc > 1) {
        for (int i = 1; i < argc; i++) {
            passwords.emplace_back(argv[i]);
        }
    } else {
        std::cout << "No passwords provided. Analyzing examples...\n\n";
        passwords = {"password123", "Tr0ub4dor&3", "correcthorsebatterystaple", "9f$K#mP!xQ2v"};
    }

    for (const auto& pw : passwords) {
        PasswordAnalysis analysis = analyzePassword(pw);
        printReport(analysis);

        // Print JSON output
        json j = analysisToJson(analysis);
        std::cout << "\nJSON Output:\n" << j.dump(2) << "\n\n";
    }

    return 0;
}

# Password Strength Analyzer - C++ (Trial 1)

A command-line tool that evaluates password strength using entropy calculation, pattern detection, dictionary checks, and crack time estimation.

## Dependencies

- **OpenSSL** (system): Provides SHA-256 hashing for password fingerprinting and cryptographic utilities.
- **nlohmann/json** (3.11.3): A modern C++ JSON library for structured output serialization.

## Setup

```bash
mkdir build && cd build
cmake ..
cmake --build .
```

## Usage

```bash
./password_analyzer "mypassword" "Str0ng!P@ss"
```

Or run with default examples:

```bash
./password_analyzer
```

## Features

- Shannon entropy and charset-based entropy calculation
- SHA-256 password fingerprinting via OpenSSL
- Pattern detection (sequential, keyboard, repeat, date, l33t, dictionary)
- Crack time estimation for multiple attack scenarios
- JSON structured output via nlohmann/json
- Character composition analysis