I have worked on this password strength checker for some time, and it’s recently been updated to work with the newer NIST recommendations. As well as checking length and for certain common combinations, it also checks for common passwords (with certain changes made to them, like leet substitution, characters added to the beginning / end of the common password, etc.), and the common password list is configurable.

Having said that, in many cases I would recommend a good front-end solution, such as the previously mentioned zxcvbn, which also checks for common passwords (with changes). The reason why I am suggesting zxcvbn is that it provides more immediate feedback to the user, and that can be very useful when encouraging users to choose strong passwords.

Sorry to bump an old thread but this was something that I needed as well. I went ahead and ported the zxcvbn for Elixir. Hopefully, this turns out to be useful for others coming back to this thread.

@ajoao or anyone else interested in this. Partially inspired by this thread (and the fact that there didn’t appear to be any password validators or checkers on hex) I’ve created a simple password validator library:

The original requirements would look like this with PasswordValidator:

opts = [
  length: [min: 6, max: 32],
  character_set: [
    lower_case: 1,  # at least one lower case letter
    upper_case: 1,  # at least one capital letter
    numbers: 1,  # at least one numbers
    special: [0, 0],  # no special characters allowed
  ]
]

changeset
|> PasswordValidator.validate(:password, opts)

Please feel free to check it out and give me any feedback (including on the code structure). I’ll probably try to do some sort of larger forum post in the near future but wanted to mention it here first.