Documentation
¶
Overview ¶
Package passwdpolicy enforces password strength and complexity requirements before a password is hashed and stored. Use it at the point of password creation and change, then pass the validated password to crypto.HashPassword.
Quick start:
policy := passwdpolicy.OWASP()
if violations := policy.Validate(password); len(violations) > 0 {
// return violations to the user
}
Custom policy:
policy := passwdpolicy.Policy{
MinLength: 12,
RequireUpper: true,
RequireDigit: true,
RequireSpecial: true,
MinEntropy: 40,
}
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Policy ¶
type Policy struct {
// MinLength is the minimum password length (default: 8).
MinLength int
// MaxLength is the maximum password length. 0 means no limit.
// Setting a very low maximum (< 64) is not recommended.
MaxLength int
// RequireUpper requires at least one uppercase letter (A-Z).
RequireUpper bool
// RequireLower requires at least one lowercase letter (a-z).
RequireLower bool
// RequireDigit requires at least one decimal digit (0-9).
RequireDigit bool
// RequireSpecial requires at least one special/punctuation character.
RequireSpecial bool
// MinEntropy is the minimum estimated entropy in bits.
// Entropy is estimated from the password character class diversity and length.
// A value of 0 disables the entropy check.
// 28 bits ≈ weak, 36 bits ≈ reasonable, 60 bits ≈ strong.
MinEntropy float64
// DisallowCommon rejects passwords found in the built-in list of the most
// commonly used passwords (top ~100).
DisallowCommon bool
// Blocklist is an additional set of exact strings to reject (case-insensitive).
// Use this to block company names, product names, or context-specific terms.
Blocklist []string
}
Policy defines the rules a password must satisfy.
func OWASP ¶
func OWASP() Policy
OWASP returns a policy aligned with the OWASP Authentication Cheat Sheet recommendations: minimum 8 characters, no maximum, no mandatory complexity rules (rely on length and entropy instead), common password rejection.
Reference: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
func Strict ¶
func Strict() Policy
Strict returns a high-security policy suitable for privileged accounts, service credentials, and admin panels.
type Strength ¶
type Strength int
Strength represents a qualitative password strength level.
func EstimateStrength ¶
EstimateStrength returns a qualitative strength rating for password. This is useful for driving a UI strength meter independently of policy validation.
Source Files