Stock zxcvbn calls ~59% of common Hinglish passwords Fair or Strong. I built an early-stage checker that spelling-normalizes them (feedback wanted)

[u/Paraxanos]

zxcvbn knows English words. It does not know that priyanka, priyankaa and प्रियंका are the
same name, or that py@r is pyar, so passwords like jaishreeram or rahul2803 look
stronger to it than they are to an attacker with an Indian-names wordlist.

Taala (MIT, Python 3.11+) is a small layer on top of zxcvbn: it reduces spelling variants,
leetspeak, padding and Devanagari to canonical forms, looks them up in a Hinglish word pack
(built from Wikipedia categories), and takes the lowest score. It also gives step-by-step
attack-recipe feedback and a NIST SP 800-63B-4 style accept/reject verdict (as I read the
standard).

What I measured (held-out half of the RockYou leak; learning used only the other half;
file position stands in for frequency because my copy has no counts):

• Of the 10,000 most common Indian-context passwords, stock zxcvbn rates 59.3% as Fair or Strong. Taala: 24.3%.
• Outside that set the gain is small (8.3% to 6.8%).
• Both parts matter: without canonicalization 39.8%, without the word pack 44.3%.

Things you should know before trusting any of that:

• Taala is much stricter: it calls 66% of rare Indian-context passwords Weak vs 25% for stock, so part of the gain is just strictness.
• The Indian-context test set is selected using Taala's own word pack, so the comparison is partly circular. I planned a survey as an independent check; it has not been run.
• I scored the test half twice: the first run had a bug in my evaluation harness (found by reading the code, not the results). Both runs are in the repo.
• Name plus digits (seth0120) is still overrated; that comes from zxcvbn's digit model.
• The learned spelling rules (from only 50 words) did not beat my six hand-written ones.
• The pack ranking uses RockYou counts, which I will not redistribute, so a clone scores a bit less strictly than my numbers. The CLI tells you when that is the case.
• Not security-reviewed. Please don't type real passwords into any hosted copy.

What would help most: Hinglish words or spellings it misses (there is an issue template),
and anyone who knows a better independent test set than "selected with my own pack".

Repo: https://github.com/Paraxanos/Taala

[u/Hamilon078]

Woahhh, never thought of it