Answer me.

[sahithyandev]

1. Why isn't it showing suggestions for "not having special characters or uppercase letters"?
2. Is there a way to include user-biased words?

[MrWook]

Funny title :D

1. What do you mean by that? Did it work previously? Can you show me a password example? If you mean those weird "suggestions": "your password need to have atleast 1 uppercase, 1 lowercase 1 special character a number and need to be 8 characters long". It's the intend of this library to get rid of those false suggestion. A password with these "suggestions" is not save at all. For example P4$$w0rd is a common used password but matches the "suggestion above" and is easily hacked.
   A quote from the original repo README.md

Consider using zxcvbn as an algorithmic alternative to password composition policy — it is more secure, flexible, and usable when sites require a minimal complexity score in place of annoying rules like "passwords must contain three of {lower, upper, numbers, symbols}".

2. Do you mean userInput like to check if the user tries to use the username as a password? You can use a userInput dictionary. It's the third point in the migration guide. I will add it as a separated entry in the documentation

[sahithyandev]

I didn't know how to write the title. So I went with a simple one 😁

Yeah, you are right, "P4@$$w0rd" is not much safe. But, "@Sahithyan'sHome" is so safe than "sahithyan". Don't you agree?
I don't mean that it must be a rule that every type of character must be present in a password.
I am just telling that, it can go as a suggestion (at least when the score is lower than 2 or 1).

And sorry. I didn't it fully.
I don't know why I skip out things in the documentations or other written guides.

By the way, If you don't agree with me on the 1st question, that's fine. I am just going to use it in one side project and never gonna think about it again. So it's fine for me.

[MrWook]

The problem with P4$$w0rd is that it is a common password. sahithyan isn't safe either in some countries because it is a name. In germany it would be safe because just a couple of people have this name. That is why it is needed to have dictionaries for different countries.

If you think that it would be a nice suggestion you can implement it on your side. Check the score and extend the feedback object.

[sahithyandev]

At first, I wanted to do that. No one is going to use it, so why should I develop it? So I didn't. I started the project just to check out MongoDB and Severless functions.

…

On Fri, 8 Jan 2021, 6:48 pm MrWook, ***@***.***> wrote: The problem with P4$$w0rd is that it is a common password. sahithyan isn't safe either in some countries because it is a name. In germany it would be safe because just a couple of people have this name. That is why it is needed to have dictionaries for different countries. If you think that it would be a nice suggestion you can implement it on your side. Check the score and extend the feedback object. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#15 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHASHB23N4HGEAEHBGBCLOLSY4A3PANCNFSM4VW3B47Q> .

[MrWook]

Just for documentation purposes:
With the 1.0.0 release it is possible to add custom matcher. This means you could add a matcher which checks for different kind of letters and can return a feedback with "at least one special characters and uppercase letters"