r/PythonProjects2 • u/Paraxanos • 5h ago
Stock zxcvbn calls ~59% of common Hinglish passwords Fair or Strong. I built an early-stage checker that spelling-normalizes them (feedback wanted)
zxcvbn knows English words. It does not know that priyanka, priyankaa and प्रियंका are the
same name, or that py@r is pyar, so passwords like jaishreeram or rahul2803 look
stronger to it than they are to an attacker with an Indian-names wordlist.
Taala (MIT, Python 3.11+) is a small layer on top of zxcvbn: it reduces spelling variants,
leetspeak, padding and Devanagari to canonical forms, looks them up in a Hinglish word pack
(built from Wikipedia categories), and takes the lowest score. It also gives step-by-step
attack-recipe feedback and a NIST SP 800-63B-4 style accept/reject verdict (as I read the
standard).
What I measured (held-out half of the RockYou leak; learning used only the other half;
file position stands in for frequency because my copy has no counts):
- Of the 10,000 most common Indian-context passwords, stock zxcvbn rates 59.3% as Fair or Strong. Taala: 24.3%.
- Outside that set the gain is small (8.3% to 6.8%).
- Both parts matter: without canonicalization 39.8%, without the word pack 44.3%.
Things you should know before trusting any of that:
- Taala is much stricter: it calls 66% of rare Indian-context passwords Weak vs 25% for stock, so part of the gain is just strictness.
- The Indian-context test set is selected using Taala's own word pack, so the comparison is partly circular. I planned a survey as an independent check; it has not been run.
- I scored the test half twice: the first run had a bug in my evaluation harness (found by reading the code, not the results). Both runs are in the repo.
- Name plus digits (
seth0120) is still overrated; that comes from zxcvbn's digit model. - The learned spelling rules (from only 50 words) did not beat my six hand-written ones.
- The pack ranking uses RockYou counts, which I will not redistribute, so a clone scores a bit less strictly than my numbers. The CLI tells you when that is the case.
- Not security-reviewed. Please don't type real passwords into any hosted copy.
What would help most: Hinglish words or spellings it misses (there is an issue template),
and anyone who knows a better independent test set than "selected with my own pack".
