This code snippet shows an implementation of a password policy check. - The method composition uses regex to verify that the password meets composition criteria (at least one number, one special character, one capital letter and length between 8 and 64) - The method check_strength() uses the library zxcvbn to check a password's strength

Initial setup:

pip install zxcvbn

Code:

import re
from zxcvbn import zxcvbn

def composition(password):
    number = "(?=.*\d)"
    upper_lower = "(?=.*[a-z])(?=.*[A-Z])"
    special = "[^A-Za-z0-9]"
    length = ".{8,64}$"

    test = []
    test.append(True if re.search(re.compile(number), password) else False)
    test.append(True if re.search(re.compile(upper_lower), password) else False)
    test.append(True if re.search(re.compile(special), password) else False)
    test.append(True if re.search(re.compile(length), password) else False)
    
    return test

def check_strength(password):
    result = zxcvbn(password, user_inputs=['John', 'Smith'])
    strength = {
        0: "Worst",
        1: "Bad",
        2: "Weak",
        3: "Good",
        4: "Strong"
    }

    return [result['score'], strength[result['score']], result['feedback']]



def main():
    password = 'Abcdefghi1.'

    x = composition(password)
    print("composition: ", x)

    y = check_strength(password)
    print("check_strength: ", y)

    return None

if __name__ == '__main__':
    main()

1- Do you think the implementation of this code snippet is up-to-date and secure?

2- Would you make any other changes to this code snippet?

3- Did you use any additional resources while checking the code? If yes, please provide a link or description of your resource.