Analyzing Password-Strength Meters - Sources

Dictionaries involved in this project include:

plus additional created dictionaries based on the above ones, a Top 10k and a 37k-word version of MySpace phishing attack leak, and using mangling rules and leet transformations.

All dictionaries involved are available for download: (15.3MiB).

The results of our tests against each checker are also available here: checkers_dictionaries_results.7z (203MiB) including aggregated results that allow for the generation of password distribution graphs (updated to include results for the extended work in my thesis).

An illustration of Google checker's hysteresis phenomenon can be found in this video.

Scripts used to automate the tests: