Password Strength Analyzer (python, written by Claude Code)

Claude Code wrote this python project from the task below. It installed and ran on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: Password Strength Analyzer

Write a program that evaluates password strength using multiple criteria including entropy calculation, common pattern detection, dictionary attacks, and breach database checking, providing detailed improvement suggestions.

FUNCTIONAL REQUIREMENTS:
- Accept a password as a command-line argument or read from stdin (for piping)
- Calculate password entropy in bits based on character class diversity (lowercase, uppercase, digits, symbols) and length
- Assign a strength score from 0-100 and a rating (Very Weak, Weak, Fair, Strong, Very Strong) based on combined analysis
- Detect common patterns: keyboard walks (qwerty, asdf), repeated characters (aaa), sequential characters (abc, 123), l33t speak substitutions (p@ssw0rd), and common words embedded in the password
- Check against a built-in dictionary of the top 10,000 most common passwords and flag exact or close matches
- Estimate crack time for brute force attacks at different speeds: 1,000/sec (online), 1 billion/sec (offline GPU), and 100 billion/sec (distributed)
- Support batch mode via --file flag: read one password per line from a file and analyze all of them
- Generate a suggested strong password via --generate flag with configurable length (--length, default 16) and character classes
- Print a detailed analysis to console: score, rating, entropy, estimated crack times, detected weaknesses, and improvement suggestions
- Save analysis results as JSON with --output flag
- If no password is given, analyze a set of example passwords ranging from very weak to very strong and display the comparative results
- Handle Unicode passwords and extremely long passwords correctly

Create a complete Python project for a clean Ubuntu 22.04 machine with only Python 3.10+ installed. Include:
- Source code
- requirements.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

"""
Password Strength Analyzer

Evaluates password strength using the zxcvbn library, which provides
entropy calculation, pattern detection, dictionary checks, and crack
time estimation.
"""

import sys
import math
from zxcvbn import zxcvbn


def analyze_password(password: str) -> dict:
    """
    Analyze the strength of a given password.

    Args:
        password: The password string to evaluate.

    Returns:
        A dictionary containing the analysis results with keys:
            - password: the original password (masked)
            - length: character count
            - score: strength score from 0 (worst) to 4 (best)
            - score_label: human-readable strength label
            - entropy: estimated entropy in bits
            - crack_times: dictionary of estimated crack times
            - feedback: suggestions and warnings from zxcvbn
            - patterns_detected: list of detected patterns
    """
    if not password:
        return {
            "password": "",
            "length": 0,
            "score": 0,
            "score_label": "Empty",
            "entropy": 0.0,
            "crack_times": {},
            "feedback": {"warning": "Password is empty.", "suggestions": ["Enter a password."]},
            "patterns_detected": [],
        }

    result = zxcvbn(password)

    score_labels = {
        0: "Very Weak",
        1: "Weak",
        2: "Fair",
        3: "Strong",
        4: "Very Strong",
    }

    # Calculate Shannon entropy manually as a supplementary measure
    char_freq = {}
    for ch in password:
        char_freq[ch] = char_freq.get(ch, 0) + 1
    length = len(password)
    shannon_entropy = -sum(
        (count / length) * math.log2(count / length) for count in char_freq.values()
    )
    total_entropy = shannon_entropy * length

    # Extract detected patterns
    patterns = []
    for match in result.get("sequence", []):
        pattern_info = {
            "pattern": match.get("pattern", "unknown"),
            "token": match.get("token", ""),
            "start": match.get("i", 0),
            "end": match.get("j", 0),
        }
        if match.get("dictionary_name"):
            pattern_info["dictionary"] = match["dictionary_name"]
        if match.get("l33t"):
            pattern_info["l33t_substitution"] = True
        if match.get("reversed"):
            pattern_info["reversed"] = True
        patterns.append(pattern_info)

    # Build crack time information
    crack_times = {}
    ct_display = result.get("crack_times_display", {})
    ct_seconds = result.get("crack_times_seconds", {})
    for key in ct_display:
        crack_times[key] = {
            "display": ct_display[key],
            "seconds": ct_seconds.get(key, 0),
        }

    masked = password[0] + "*" * (len(password) - 2) + password[-1] if len(password) > 2 else "*" * len(password)

    analysis = {
        "password": masked,
        "length": length,
        "score": result["score"],
        "score_label": score_labels.get(result["score"], "Unknown"),
        "entropy": round(total_entropy, 2),
        "guesses": result.get("guesses", 0),
        "guesses_log10": round(result.get("guesses_log10", 0), 2),
        "crack_times": crack_times,
        "feedback": result.get("feedback", {}),
        "patterns_detected": patterns,
    }

    return analysis


def format_report(analysis: dict) -> str:
    """
    Format an analysis result into a human-readable report string.

    Args:
        analysis: The dictionary returned by analyze_password.

    Returns:
        A formatted multi-line string report.
    """
    lines = []
    lines.append("=" * 60)
    lines.append("       PASSWORD STRENGTH ANALYSIS REPORT")
    lines.append("=" * 60)
    lines.append(f"  Password (masked): {analysis['password']}")
    lines.append(f"  Length:            {analysis['length']} characters")
    lines.append(f"  Score:             {analysis['score']}/4 - {analysis['score_label']}")
    lines.append(f"  Entropy:           {analysis['entropy']} bits")
    lines.append(f"  Guesses (log10):   {analysis.get('guesses_log10', 'N/A')}")
    lines.append("")

    # Crack times
    lines.append("  Crack Time Estimates:")
    lines.append("  " + "-" * 50)
    for scenario, times in analysis.get("crack_times", {}).items():
        label = scenario.replace("_", " ").title()
        lines.append(f"    {label}: {times['display']}")
    lines.append("")

    # Feedback
    feedback = analysis.get("feedback", {})
    warning = feedback.get("warning", "")
    suggestions = feedback.get("suggestions", [])
    if warning:
        lines.append(f"  Warning: {warning}")
    if suggestions:
        lines.append("  Suggestions:")
        for s in suggestions:
            lines.append(f"    - {s}")
    if not warning and not suggestions:
        lines.append("  No warnings or suggestions. Good password!")
    lines.append("")

    # Patterns
    patterns = analysis.get("patterns_detected", [])
    if patterns:
        lines.append("  Detected Patterns:")
        lines.append("  " + "-" * 50)
        for p in patterns:
            detail = f"    [{p['pattern']}] \"{p['token']}\" (pos {p['start']}-{p['end']})"
            if p.get("dictionary"):
                detail += f" dict={p['dictionary']}"
            if p.get("l33t_substitution"):
                detail += " [l33t]"
            if p.get("reversed"):
                detail += " [reversed]"
            lines.append(detail)
    else:
        lines.append("  No common patterns detected.")

    lines.append("=" * 60)
    return "\n".join(lines)


def main():
    """Main entry point for the password strength analyzer."""
    print("Password Strength Analyzer")
    print("-" * 40)

    if len(sys.argv) > 1:
        passwords = sys.argv[1:]
    else:
        print("Enter passwords to analyze (one per line, empty line to finish):")
        passwords = []
        while True:
            try:
                pw = input("> ")
                if not pw:
                    break
                passwords.append(pw)
            except EOFError:
                break

    if not passwords:
        print("No passwords provided. Analyzing example passwords...")
        passwords = ["password123", "Tr0ub4dor&3", "correcthorsebatterystaple", "9f$K#mP!xQ2v"]

    for pw in passwords:
        analysis = analyze_password(pw)
        report = format_report(analysis)
        print(report)
        print()


if __name__ == "__main__":
    main()

# Password Strength Analyzer - Python (Trial 1)

A command-line tool that evaluates password strength using entropy calculation, pattern detection, dictionary checks, and crack time estimation.

## Dependencies

- **zxcvbn** (4.4.28): A realistic password strength estimator inspired by password crackers, providing pattern matching, dictionary lookups, and crack time estimates.

## Setup

```bash
pip install -r requirements.txt
```

## Usage

Analyze passwords provided as command-line arguments:

```bash
python analyzer.py "mypassword" "Tr0ub4dor&3"
```

Or run interactively:

```bash
python analyzer.py
```

## Features

- Password strength scoring (0-4 scale)
- Shannon entropy calculation
- Crack time estimation for multiple attack scenarios
- Pattern detection (dictionary words, sequences, repeats, dates, l33t substitutions)
- Actionable feedback and suggestions

zxcvbn==4.4.28