diff --git a/.travis.yml b/.travis.yml
index 0a61ab42..be78c852 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,9 +2,4 @@ sudo: false
language: node_js
node_js:
- node
-script: npm run test-saucelabs
-env:
- global:
- - secure: HayVPsMiZwrVLVg5XOUs8Ee3mW3IMvOpFzBcN9bocJAHSwzPNArZrlUX4Qr8mp7RxE4Znoj8Yu6/HRpqCD1S4LxmUXzFFslCWHyZEjxeLkxF8gPqgVA2aVrWxfRpQQW9jT2M/aiGSNO6bgI7GQP/uQkH+Au2v3DWXrGNvMNhVbI=
- - secure: giszMTdqUHRey+TDdoO3OnTdj64A27emUKRgX6SwuN0uu2D3av7624skgJqfAgJMPpho1WgkW6ujqRu3CeCBMQWcGeADtKkGvAYu7gHru6nYm5RifjadMQyrUH7hF/SkEHv44rPaHPiVEQ0N7pN192jmTXgptUHqfvfdJR6bD+M=
-
+script: npm run test
diff --git a/.zuul.yml b/.zuul.yml
index 4fa88c8a..625b7f11 100644
--- a/.zuul.yml
+++ b/.zuul.yml
@@ -17,4 +17,3 @@ browserify:
- options:
extensions:
- .coffee
-
diff --git a/LICENSE.txt b/LICENSE.txt
index 4f083a08..fc051195 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -1,4 +1,4 @@
-Copyright (c) 2012-2015 Dan Wheeler and Dropbox, Inc.
+Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc.
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
diff --git a/README.md b/README.md
index 0a561cb8..f110a62c 100644
--- a/README.md
+++ b/README.md
@@ -10,21 +10,36 @@ ________________________________________________________________________
[](https://travis-ci.org/dropbox/zxcvbn)
[](https://saucelabs.com/u/dropbox-zxcvbn)
-`zxcvbn` is a password strength estimator inspired by password crackers. Through pattern matching and conservative entropy calculations, it recognizes and weighs 30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (`aaa`), sequences (`abcd`), keyboard patterns (`qwertyuiop`), and l33t speak.
+`zxcvbn` is a password strength estimator inspired by password crackers. Through pattern matching and conservative estimation, it recognizes and weighs 30k common passwords, common names and surnames according to US census data, popular English words from Wikipedia and US television and movies, and other common patterns like dates, repeats (`aaa`), sequences (`abcd`), keyboard patterns (`qwertyuiop`), and l33t speak.
Consider using zxcvbn as an algorithmic alternative to password composition policy — it is more secure, flexible, and usable when sites require a minimal complexity score in place of annoying rules like "passwords must contain three of {lower, upper, numbers, symbols}".
* __More secure__: policies often fail both ways, allowing weak passwords (`P@ssword1`) and disallowing strong passwords.
* __More flexible__: zxcvbn allows many password styles to flourish so long as it detects sufficient complexity — passphrases are rated highly given enough uncommon words, keyboard patterns are ranked based on length and number of turns, and capitalization adds more complexity when it's unpredictaBle.
-* __More usable__: Use zxcvbn to build simple, rule-free interfaces that give instant feedback. In addition to scoring, zxcvbn includes minimal, targeted verbal feedback that can help guide users towards less guessable passwords.
-
-At Dropbox we use zxcvbn on our [signup page](https://www.dropbox.com/register) and change/reset password flows. zxcvbn is designed for node and the browser, but we use our [python port](https://github.com/dropbox/python-zxcvbn) inside the Dropbox desktop client, [Objective C port](https://github.com/dropbox/zxcvbn-ios) in our iOS app, and Java port (not yet open sourced) on Android.
-
-[Release notes](https://github.com/dropbox/zxcvbn/releases)
-
-For more motivation, see:
-
-http://tech.dropbox.com/?p=165
+* __More usable__: zxcvbn is designed to power simple, rule-free interfaces that give instant feedback. In addition to strength estimation, zxcvbn includes minimal, targeted verbal feedback that can help guide users towards less guessable passwords.
+
+For further detail and motivation, please refer to the USENIX Security '16 [paper and presentation](https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler).
+
+At Dropbox we use zxcvbn ([Release notes](https://github.com/dropbox/zxcvbn/releases)) on our web, desktop, iOS and Android clients. If JavaScript doesn't work for you, others have graciously ported the library to these languages:
+
+* [`zxcvbn-python`](https://github.com/dwolfhub/zxcvbn-python) (Python)
+* [`zxcvbn-cpp`](https://github.com/rianhunter/zxcvbn-cpp) (C/C++/Python/JS)
+* [`zxcvbn-c`](https://github.com/tsyrogit/zxcvbn-c) (C/C++)
+* [`zxcvbn-rs`](https://github.com/shssoichiro/zxcvbn-rs) (Rust)
+* [`zxcvbn-go`](https://github.com/nbutton23/zxcvbn-go) (Go)
+* [`zxcvbn4j`](https://github.com/nulab/zxcvbn4j) (Java)
+* [`nbvcxz`](https://github.com/GoSimpleLLC/nbvcxz) (Java)
+* [`zxcvbn-ruby`](https://github.com/envato/zxcvbn-ruby) (Ruby)
+* [`zxcvbn-js`](https://github.com/bitzesty/zxcvbn-js) (Ruby [via ExecJS])
+* [`zxcvbn-ios`](https://github.com/dropbox/zxcvbn-ios) (Objective-C)
+* [`zxcvbn-cs`](https://github.com/mickford/zxcvbn-cs) (C#/.NET)
+* [`szxcvbn`](https://github.com/tekul/szxcvbn) (Scala)
+* [`zxcvbn-php`](https://github.com/bjeavons/zxcvbn-php) (PHP)
+* [`zxcvbn-api`](https://github.com/wcjr/zxcvbn-api) (REST)
+* [`ocaml-zxcvbn`](https://github.com/cryptosense/ocaml-zxcvbn) (OCaml bindings for `zxcvbn-c`)
+
+Integrations with other frameworks:
+* [`angular-zxcvbn`](https://github.com/ghostbar/angular-zxcvbn) (AngularJS)
# Installation
@@ -44,7 +59,7 @@ bower install zxcvbn
Add this script to your `index.html`:
``` html
-
```
@@ -56,7 +71,7 @@ To pull in updates and bug fixes:
bower update zxcvbn
```
-## Node / npm
+## Node / npm / MeteorJS
zxcvbn works identically on the server.
@@ -67,11 +82,6 @@ $ node
> zxcvbn('Tr0ub4dour&3');
```
-## Meteor (via [Atmosphere](https://atmospherejs.com/codetheweb/zxcvbn))
-``` shell
-meteor add codetheweb:zxcvbn
-```
-
## RequireJS
Add [`zxcvbn.js`](https://raw.githubusercontent.com/dropbox/zxcvbn/master/dist/zxcvbn.js) to your project (using bower, npm or direct download) and import as usual:
@@ -122,13 +132,12 @@ Download [zxcvbn.js](https://raw.githubusercontent.com/dropbox/zxcvbn/master/dis
Add to your .html:
``` html
-
+
```
# Usage
-[try zxcvbn interactively](https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html) to see these docs in action.
+[try zxcvbn interactively](https://lowe.github.io/tryzxcvbn/) to see these docs in action.
``` javascript
zxcvbn(password, user_inputs=[])
@@ -140,7 +149,7 @@ zxcvbn(password, user_inputs=[])
result.guesses # estimated guesses needed to crack password
result.guesses_log10 # order of magnitude of result.guesses
-result.crack_time_seconds # dictionary of back-of-the-envelope crack time
+result.crack_times_seconds # dictionary of back-of-the-envelope crack time
# estimations, in seconds, based on a few scenarios:
{
# online attack on a service that ratelimits password auth attempts.
@@ -163,9 +172,9 @@ result.crack_time_seconds # dictionary of back-of-the-envelope crack time
offline_fast_hashing_1e10_per_second
}
-result.crack_time_display # same keys as result.crack_time_seconds,
- # with friendlier display string values:
- # "less than a second", "3 hours", "centuries", etc.
+result.crack_times_display # same keys as result.crack_times_seconds,
+ # with friendlier display string values:
+ # "less than a second", "3 hours", "centuries", etc.
result.score # Integer from 0-4 (useful for implementing a strength bar)
@@ -204,19 +213,19 @@ zxcvbn operates below human perception of delay for most input: ~5-20ms for ~25
## script load latency
-`zxcvbn.js` bundled and minified is about 390kb gzipped or 800kb uncompressed, most of which is dictionaries. Consider these tips if you're noticing page load latency on your site.
+`zxcvbn.js` bundled and minified is about 400kB gzipped or 820kB uncompressed, most of which is dictionaries. Consider these tips if you're noticing page load latency on your site.
-* Make sure your server is configured to compress static assets for browsers that support it. ([nginx tutorial](https://rtcamp.com/tutorials/nginx/enable-gzip/), [apache/IIS tutorial](http://betterexplained.com/articles/how-to-optimize-your-site-with-gzip-compression/).)
+* Make sure your server is configured to compress static assets for browsers that support it. ([nginx tutorial](https://rtcamp.com/tutorials/nginx/enable-gzip/), [Apache/IIS tutorial](http://betterexplained.com/articles/how-to-optimize-your-site-with-gzip-compression/).)
Then try one of these alternatives:
-1. Put your `