commonpasswords

Overview ¶

Command commonpasswords builds internal/auth/common-passwords.txt, the list of common passwords that new passwords are checked against (NIST SP 800-63B, PHASE1 step 10). Origin and license: THIRD_PARTY.md.

It reads the top one million of Mark Burnett's ten million passwords as published in SecLists, checks the file against a pinned SHA-256, and keeps what the password policy could still accept: 12 to 256 characters. Entries are lower-cased (the check ignores case), deduplicated and sorted, so the output is the same on every machine.

Usage:

curl -o xato.txt <Source>
go run ./internal/tools/commonpasswords -in xato.txt -out internal/auth/common-passwords.txt