Abstract security interface showing password strength and policy analysis panels
passguardjs v0.3.1 is live on npm

PassGuardJS

Lightweight password strength and policy analysis with typed ESM/CommonJS builds, personal-info blocking, and detailed validation feedback.

Install from npmView on GitHubDocumentation

Features

Built for useful password feedback

PassGuardJS goes beyond checking whether a password matches a regex. It helps developers explain what is weak, what passed, and what the user can improve.

Password strength analysis

Score passwords from 0 to 100 with strength labels and policy-aware validation feedback.

Custom password policy support

Configure length limits, score thresholds, character requirements, banned terms, and custom rules.

Common password detection

Flag predictable passwords and extend the built-in list with your own blocked values.

Keyboard pattern detection

Detect keyboard walks such as qwerty, asdf, and similar predictable patterns.

Repeated character detection

Catch repeated runs such as aaaaaa or 111111 before they pass a format-only check.

Sequential character detection

Block ascending or descending runs such as abcdef, 123456, and fedcba.

Personal information detection

Compare passwords against names, emails, usernames, birth years, phone numbers, and locations.

Typed ESM and CommonJS builds

Ships editor-friendly TypeScript definitions for browser, Node.js, ESM, and CommonJS usage.

Zero dependency focus

Designed as a lightweight runtime dependency-free package for JavaScript projects.

Release

Updated for passguardjs v0.3.1

The site now reflects the package currently published on npm, including the expanded personal-information policy surface.

Latest

v0.3.1 is live on npm

The website installs the current public package and links directly to the npm and GitHub sources.

Policy

First-class personal info fields

Use array-form inputs or named fields for name, birthYear, email, username, phoneNumber, and location.

Phone

Phone alias normalization

Bangladesh 880/local 0 phone matching works by default, with phoneCountryCodeAliases for other country codes.

Installation

Add PassGuardJS with npm

Install passguardjs v0.3.1, import the analyzer, and wire the typed result into your form UI or validation flow.

minLength: 12maxLength: 128minScore: 70requireUppercaserequireLowercaserequireNumberrequireSpecialCharblockCommonPasswordsblockUserInputsblockKeyboardPatternsblockSequentialCharactersblockRepeatedCharacterspersonalInfo.phoneNumberpersonalInfo.locationphoneCountryCodeAliasesbannedSubstringscustomRules
npm install passguardjs
quick-start.ts
import { analyzePassword } from "passguardjs";

const result = analyzePassword("Swarup@01712345678", {
  minLength: 12,
  minScore: 70,
  requireUppercase: true,
  requireLowercase: true,
  requireNumber: true,
  requireSpecialChar: true,
  blockUserInputs: true,
  blockSequentialCharacters: true,
  personalInfo: {
    name: "Swarup Saha",
    email: "swarup@example.com",
    username: "swarup",
    phoneNumber: "+8801712345678",
    location: ["Dhaka", "Bangladesh"],
  },
});

console.log(result);

Live Demo

Try the browser-only password checker

v0.3.1 local analysis

Strength score

0/100

Result

Very Weak

Status: Needs attention

All checks run locally in your browser.

Issues

  • Password is too short
  • Password must include an uppercase letter
  • Password must include a lowercase letter
  • Password must include a number
  • Password must include a special character
  • Password strength score is below the required minimum

Recommendations

  • Use at least 12 characters
  • Add at least one uppercase letter
  • Add at least one lowercase letter
  • Add at least one number
  • Add at least one special character
  • Use a longer password with more random characters

Documentation Preview

The pieces developers need first

Start with the core API, configure a policy, read the result object, and adapt the examples to your stack.

Core API

API Reference

Use analyzePassword(password, policy?) for scoring, definePasswordPolicy for reusable configs, and strengthFromScore for labels.

Configuration

Policy Options

Set length limits, minScore, required classes, common/user-input blocking, phone aliases, banned substrings, and custom rules.

Typed output

Result Object

Read score, strength, isValid, issues, suggestions, and detailed per-rule checks with optional metadata.

Frameworks

Examples

Integrate with Vanilla JS, React, Vue, Angular, Node.js, ESM imports, or CommonJS require using the same API.

Why PassGuardJS?

Regex-only validation answers the wrong question.

A regex can confirm that a password contains a number, symbol, or uppercase character. It cannot explain whether that password is common, repetitive, keyboard-like, personal, or simply too predictable for the policy you are trying to enforce.

PassGuardJS is built for meaningful analysis and developer-friendly feedback: return a score, list the issues, suggest safer choices, and keep the checks close to the product experience where users can act on them.