🔑 PassAudit

Password Strength Analyzer & Breach Checker

---

Evaluates password security through entropy analysis, structural pattern detection, and optional Have I Been Pwned breach database lookups. Your password never leaves your machine — the HIBP integration uses the k-anonymity API model.

Features

• Entropy calculation — Shannon entropy in bits based on character pool analysis
• Pattern detection — Catches keyboard walks, year patterns, leet substitutions, common fragments, and character repetition
• Breach checking — Queries the HIBP Pwned Passwords API without exposing your password (only a 5-char SHA-1 prefix is transmitted)
• Password generator — Cryptographically random passwords via secrets module
• Batch auditing — Analyze files containing one password per line
• Zero dependencies — Standard library only

Usage

# Interactive mode
python passaudit.py

# Check a specific password
python passaudit.py --check "MyP@ssw0rd123"

# Check with breach lookup
python passaudit.py --check "hunter2" --breach

# Audit a password list
python passaudit.py --file passwords.txt --breach

# Generate a strong password (default: 16 chars)
python passaudit.py --generate 24

Example Output

──────────────────────────────────────────────────
  Score:    22/100 (Weak)
  Length:   10 characters
  Entropy:  59.54 bits
  Charset:  72 symbols
  Classes:  A-Z a-z 0-9 !@#
  Breaches: EXPOSED in 46,029 breach(es)!

  Weaknesses:
    ⚠ Found in 46,029 data breach(es)
    ⚠ Contains common word: 'password'
    ⚠ Contains a year pattern (commonly guessed)
──────────────────────────────────────────────────

Scoring Methodology

Score	Rating	Meaning
80–100	Excellent	Resistant to offline attacks with current hardware
60–79	Strong	Adequate for most use cases
40–59	Fair	Vulnerable to targeted attacks
20–39	Weak	Crackable with modest resources
0–19	Critical	Trivially guessable or known-breached

The score combines theoretical entropy with practical weakness penalties. A password found in breach databases is automatically capped at "Critical" regardless of its structural strength.

Privacy

The HIBP breach check uses k-anonymity: only the first 5 characters of the password's SHA-1 hash are sent to the API. The server returns all hash suffixes matching that prefix, and comparison happens locally. Your full password hash is never transmitted.

License

MIT — see LICENSE.