unsyn / password_blacklist

Ruby gem to check a password against a blacklist of commonly used passwords

password_blacklist

Check the presence of a string in a blacklist of the top 95,000 commonly used passwords (sourced from berzerk0 's Probable-Wordlists).

This very simple Ruby library can be integrated into your registration/authentication system to prevent users from setting commonly used (and easy to guess) passwords.

This gem has an insignificant memory footprint with an execution cost of approximately 1 ms. A memory persistence option is available to further reduce execution time.

Devise Extension

Use devise_password_blacklist to easily add password blacklisting to your Rails application.

Installation

Gemfile:

gem 'password_blacklist'

Or install it yourself:

$ gem install password_blacklist

Usage

$ irb
require 'password_blacklist'

PasswordBlacklist.blacklisted?("pokemon")
=> true

PasswordBlacklist.blacklisted?("AccurateUnicornCoalPaperclip")
=> false

Test multiple passwords

The blacklist file is loaded on every call to PasswordBlacklist.blacklisted?. Use PasswordBlacklist::Checker to persist the blacklist in memory (approximately 0.8MB) if you would like to perform lots of password tests in quick succession.

require 'password_blacklist'

checker = PasswordBlacklist::Checker.new
=> #<PasswordBlacklist::Checker:0x3ff979c41758>

checker.blacklisted?("pokemon")
=> true

checker.blacklisted?("AccurateUnicornCoalPaperclip")
=> false

Supported Ruby versions

password_blacklist supports MRI Ruby 2.x. The specific Ruby versions we build and test on can be found at TravisCI.

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec or rspec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment. Use bin/benchmark to run some benchmarks.

To install this gem onto your local machine, run bundle exec rake install.

To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Run bundle exec rake spec to manually launch specs.

Contributing

Bug reports and pull requests are welcome on GitHub at https://www.github.com/gchan/password_blacklist.

1. Fork it ( https://github.com/gchan/password_blacklist/fork )
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create a new Pull Request

Licenses

password_blacklist is Copyright (c) 2017 Gordon Chan and is available as open source under the terms of the MIT License.

Top95Thousand-probable.txt is licensed under CC BY-SA 4.0 (Creative Commons Attribution-ShareAlike 4.0 International)