passeval 0.1.6

Offline ML-powered password strength evaluation using a trained Random Forest model.

passeval

Offline ML-powered password strength evaluation for Python developers.

Built on the PassSafe research model — a Random Forest classifier trained on 220,000 passwords. Runs fully locally, no API, no server.

---

Installation

pip install passeval

---

Quick Start

from passeval import evaluate_password

result = evaluate_password("Monkey2024!")
print(result)

{
  "score": 0,
  "label": "Weak",
  "confidence": 1.0,
  "features": {
    "length": 11,
    "entropy": 3.2776,
    "num_upper": 1,
    "num_digits": 4,
    "num_special": 1
  },
  "feedback": [
    "Longer passwords are significantly harder to crack",
    "Avoid predictable patterns like years or repeated digits"
  ]
}

---

Examples

from passeval import evaluate_password

evaluate_password("hunter2")["label"]                   # Weak
evaluate_password("Password1")["label"]                 # Medium
evaluate_password("blitz8-concrete2-eloquence3")["label"]  # Strong
evaluate_password("xK9#mP2$vL8@")["label"]             # Strong

---

Key Features

• 3-class scoring — Weak (0), Medium (1), Strong (2)
• Confidence score — model probability for the predicted class
• Actionable feedback — specific suggestions to improve weak passwords
• Detects breach-derived patterns — catches passwords like Monkey2024! that pass surface-level complexity checks
• Fully offline — model ships inside the package, no internet required
• Fast after warmup — model cached in memory, sub-millisecond from second call onward

---

How It Works

passeval extracts 10 statistical features from each password — length, entropy, character type counts, and boolean flags — then runs them through a trained Random Forest classifier. No raw characters are inspected; the model learns structural patterns, not specific passwords.

from passeval import extract_features

extract_features("Monkey2024!")
# {
#   'length': 11, 'num_upper': 1, 'num_lower': 6, 'num_digits': 4,
#   'num_special': 1, 'entropy': 3.2776, 'unique_chars': 10,
#   'has_upper': 1, 'has_digit': 1, 'has_special': 1
# }

---

vs zxcvbn

Unlike zxcvbn (rule-based, 55.37% accuracy on the PassSafe dataset), passeval correctly flags passwords like Monkey2024!, Dragon!, and Football!2024 as Weak — patterns that satisfy complexity rules but originate from breached credentials. On realistic weak password detection, the ML model achieves 99.93% vs zxcvbn's 32.34%.

---

Research

passeval is the inference library for the PassSafe paper:

Amgbara, S.I. (2026). PassSafe: An Intelligent Password Manager Integrating Machine Learning for Adaptive Password Strength Evaluation. Department of Computer Science, University of Hertfordshire, UK.

---

License

MIT — see LICENSE.