passeval 0.1.8

Offline ML-powered password strength evaluation using a trained Random Forest model.

passeval

Offline ML-powered password strength evaluation for Python developers.

Built on a Random Forest classifier trained on 220,000 passwords. Runs fully locally, no API, no server.

Installation

pip install passeval

Quick Start

from passeval import evaluate_password

result = evaluate_password("Monkey2024!")
print(result)

{
  "score": 0,
  "label": "Weak",
  "confidence": 1.0,
  "features": {
    "length": 11,
    "entropy": 3.2776,
    "num_upper": 1,
    "num_digits": 4,
    "num_special": 1
  },
  "feedback": [
    "Longer passwords are significantly harder to crack",
    "Avoid predictable patterns like years or repeated digits"
  ]
}

Examples

from passeval import evaluate_password

evaluate_password("hunter2")["label"]                      # Weak
evaluate_password("Password1")["label"]                    # Medium
evaluate_password("blitz8-concrete2-eloquence3")["label"]  # Strong
evaluate_password("xK9#mP2$vL8@")["label"]                # Strong

Key Features

• 3-class scoring - Weak (0), Medium (1), Strong (2)
• Confidence score - model probability for the predicted class
• Actionable feedback - specific suggestions to improve weak passwords
• Detects breach-derived patterns - catches passwords like Monkey2024! that pass surface-level complexity checks
• Fully offline - model ships inside the package, no internet required
• Fast after warmup - model cached in memory, sub-millisecond from second call onward

How It Works

passeval extracts 10 statistical features from each password (length, entropy, character type counts, boolean flags) then runs them through a trained Random Forest classifier. No raw characters are inspected; the model learns structural patterns, not specific passwords.

from passeval import extract_features

extract_features("Monkey2024!")
# {
#   'length': 11, 'num_upper': 1, 'num_lower': 6, 'num_digits': 4,
#   'num_special': 1, 'entropy': 3.2776, 'unique_chars': 10,
#   'has_upper': 1, 'has_digit': 1, 'has_special': 1
# }

vs zxcvbn

Unlike zxcvbn (rule-based, 55.37% accuracy), passeval correctly flags passwords like Monkey2024!, Dragon!, and Football!2024 as Weak. These patterns satisfy complexity rules but originate from breached credentials. On realistic weak password detection, the ML model achieves 99.93% vs zxcvbn's 32.34%.

License

MIT - see LICENSE.