Overview Version (4) Discussion (4)

• 

  Password Tools

  To increase the safety of your users account, you can force them to use passwords of a minimum lengt

  limitations

  password

  password tools
  About this resource

  

  
  This modification mostly follows the principles of Dan Wheelers password strength estimator zxcvbn. It does not weight password strength by their combination of upper/lower letters, special characters and numbers, but on how easy they are to crack in reality.
  
  To increase the safety of your users account, you can force them to use passwords of a minimum length, minimum strength and even force them to exclude certain words from their passwords (like your site name, the topic your site refers to, etc.).
  
  But the other side of the equation, is no matter how secure the password is, if it has been compromised not password strength estimator will help make it better. As such NIST has the following guidance: check passwords against those obtained from previous data breaches. Pwned Password integration does that.
  
  

  zxcvbn Readme said:

  zxcvbn is a password strength estimator inspired by password crackers. Through pattern matching and conservative entropy calculations, it recognizes and weighs 10k common passwords, common names and surnames according to US census data, popular English words, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and l33t speak.
  
  Consider using zxcvbn as an algorithmic alternative to password policy — it is more secure, flexible, and usable when sites require a minimal complexity score in place of annoying rules like "passwords must contain three of {lower, upper, numbers, symbols}".

  Click to expand...

  Pwned password said:

  Password reuse and credential stuffing
  
  Password reuse is normal. It's extremely risky, but it's so common because it's easy and people aren't aware of the potential impact. Attacks such as credential stuffing take advantage of reused credentials by automating login attempts against systems using known emails and password pairs.
  
  
  NIST's guidance: check passwords against those obtained from previous data breaches
  
  The Pwned Passwords service was created in August 2017 after NIST released guidance specifically recommending that user-provided passwords be checked against existing data breaches . The rationale for this advice and suggestions for how applications may leverage this data is described in detail in the blog post titled Introducing 306 Million Freely Downloadable Pwned Passwords. In February 2018, version 2 of the service was released with more than half a billion passwords, each now also with a count of how many times they'd been seen exposed.
  Click to expand...

  Click to expand...

  
  Features
  

  • Compromised password reuse prevention (optional)
    • Add users with compromised passwords to a custom user-group.
  • Minimum password length (optional)
  • Show password feature, allow users to toggle to see what they have actually entered.
  • Show users how strong their passwords really are when it comes to crack-attempts
  • Deliver instant feedback if password and password-confirm match and/or certain requirements are not met
  • Force users to choose passwords with a minimum strength
  • Force users to choose passwords with a minimum length
  • Force users to chooce a password not containing words from a blacklist you define
  • No cheating: This modification also controls users passwords on server side with Ben Jeavos php-implementation of zxcvbn.
  • Easy styling through XenForo Style Properties
• Version

  3.14.1 Stable Available Feb 19, 2026 · 0

  Download

  File size: 497.5 KB

  SHA-256: 04febbb4a02aa5209aaa9b8fa9c9ed4a388f5c7ece6d79424f8712faa34dd547

  SHA-256 verified Package valid Compatibility checked Last verified: Wednesday at 12:10 AM

  • Require StandardLib v1.23.0+
  • Add Custom 2fa device trust lifetime option (default disabled)
    • Phrase to customize: svPasswordTools_trust_device_desc_x / svPasswordTools_trust_this_device_for_30_days_x
      Only plural phrases, because why would you force 2fa to 1 day. That is horrible.

  3.13.1 Stable Available Jan 5, 2026 · 0

  Download

  File size: 495.4 KB

  SHA-256: 2461990c057b910fb2cb90db438f31e065a48e9aeaf83dcc27d528241767b522

  SHA-256 verified Package valid Compatibility checked Last verified: Wednesday at 12:10 AM

  • Remove unused style properties

  3.13.0 Stable Available Dec 14, 2025 · 0

  Download

  File size: 495.9 KB

  SHA-256: 5a751e7d2231a7a1c8714b0552daf7145a71cb8ca89cd3a60c41e601c6f4cc45

  SHA-256 verified Package valid Compatibility checked Last verified: Wednesday at 12:10 AM

  • Require StandardLib v1.22.0+
  • Reduce pwnedpassword check HTTP request time-out from 2 seconds to 1 second as this blocks the login request, the request should only take a few 10s of milliseconds, so fail faster instead of waiting
  • Add password test page, this tests all the ways a password could fail including methods which aren't enabled

  3.12.2 Stable Available Dec 7, 2025 · 0

  Download

  File size: 492.7 KB

  SHA-256: 23cbf0f0a0491b4b2843974976e77ebe98ff86b89156172579d0b9563d29d2d1

  SHA-256 verified Package valid Compatibility checked Last verified: Wednesday at 12:10 AM

  View attachment 1943​

  
  This modification mostly follows the principles of Dan Wheelers password strength estimator zxcvbn. It does not weight password strength by their combination of upper/lower letters, special characters and numbers, but on how easy they are to crack in reality.
  
  To increase the safety of your users account, you can force them to use passwords of a minimum length, minimum strength and even force them to exclude certain words from their passwords (like your site name, the topic your site refers to, etc.).
  
  But the other side of the equation, is no matter how secure the password is, if it has been compromised not password strength estimator will help make it better. As such NIST has the following guidance: check passwords against those obtained from previous data breaches. Pwned Password integration does that.
  
  

  zxcvbn Readme said:

  zxcvbn is a password strength estimator inspired by password crackers. Through pattern matching and conservative entropy calculations, it recognizes and weighs 10k common passwords, common names and surnames according to US census data, popular English words, and other common patterns like dates, repeats (aaa), sequences (abcd), keyboard patterns (qwertyuiop), and l33t speak.
  
  Consider using zxcvbn as an algorithmic alternative to password policy — it is more secure, flexible, and usable when sites require a minimal complexity score in place of annoying rules like "passwords must contain three of {lower, upper, numbers, symbols}".

  Click to expand...

  Pwned password said:

  Password reuse and credential stuffing
  
  Password reuse is normal. It's extremely risky, but it's so common because it's easy and people aren't aware of the potential impact. Attacks such as credential stuffing take advantage of reused credentials by automating login attempts against systems using known emails and password pairs.
  
  
  NIST's guidance: check passwords against those obtained from previous data breaches
  
  The Pwned Passwords service was created in August 2017 after NIST released guidance specifically recommending that user-provided passwords be checked against existing data breaches . The rationale for this advice and suggestions for how applications may leverage this data is described in detail in the blog post titled Introducing 306 Million Freely Downloadable Pwned Passwords. In February 2018, version 2 of the service was released with more than half a billion passwords, each now also with a count of how many times they'd been seen exposed.
  Click to expand...

  Click to expand...

  
  Features
  

  • Compromised password reuse prevention (optional)
    • Add users with compromised passwords to a custom user-group.
  • Minimum password length (optional)
  • Show password feature, allow users to toggle to see what they have actually entered.
  • Show users how strong their passwords really are when it comes to crack-attempts
  • Deliver instant feedback if password and password-confirm match and/or certain requirements are not met
  • Force users to choose passwords with a minimum strength
  • Force users to choose passwords with a minimum length
  • Force users to chooce a password not containing words from a blacklist you define
  • No cheating: This modification also controls users passwords on server side with Ben Jeavos php-implementation of zxcvbn.
  • Easy styling through XenForo Style Properties
• Discussion

  This resource has a discussion thread on the forum where you can ask questions, report issues, and talk with the author and other users.

  Join the discussion (4)