Evaluate @zxcvbn-ts/core
capability to meet defined password strength requirements and scoring
As a developer,
I want to verify which of the approved password requirements
and scoring levels can be implemented using the @zxcvbn-ts/core library,
and identify any gaps or limitations, so that we can decide whether to continue using it
or adopt an alternative (or both).
Description
After defining and approving password requirements and scoring levels in the previous issue, the next step is to assess implementation feasibility with the existing library @zxcvbn-ts/core. The goal is to:
- Check which approved requirements and scoring aspects can be implemented or configured directly via
zxcvbn
. - Identify which cannot be supported and research suitable alternative library/libraries.
- Produce a Markdown comparison table showing each requirement, potential implementation via
zxcvbn
, alternative options (if needed), and a summary evaluation (+
/-
). - Post the table as a comment under the current issue ticket.
- Based on findings, propose whether to continue using
zxcvbn
, switch to an alternative, or combine both.
Acceptance Criteria
-
Review @zxcvbn-ts/core
documentation and behaviour. -
Compare each approved requirement and scoring rule against zxcvbn
's available configuration and scoring model. -
Create a Markdown table in the following format: | Requirement | Supported by zxcvbn
? | Alternative(s) | Evaluation (+/-) | Notes | -
Add the resulting Markdown table as a comment to this issue. -
Tag PM and relevant team members for review. -
Research and document any recommended alternative libraries (e.g. owasp-password-strength-test, check-password-strength, etc.) if gaps exist. -
Define final decision in the issue comment on whether to: - Continue using
zxcvbn
only, - Replace it with an alternative, or
- Combine both.
- Continue using
-
If changes are needed, update or correct a subsequent issue ticket accordingly.
Edited by Eugene E.