Case study 02

Password strength analysis

Compared generated password samples across Bitwarden CLI, PasswordWolf and a custom Python generator, examining how length and character policy affect estimated strength.

Python
zxcvbn
Security analysis

450,000samples in saved results

3generators compared

15policy and length combinations

What the analysis did

Samples from three generators were scored with zxcvbn. Estimated guesses depended on length; the generator made no difference to the medians.

Median estimated guesses by length

8 characters10⁸ guesses

zxcvbn score 2 of 4 · about 0.01 seconds offline

12 characters10¹² guesses

zxcvbn score 4 of 4 · about 100 seconds offline

20 characters10²⁰ guesses

zxcvbn score 4 of 4 · about 317 years offline

Medians were the same for Bitwarden CLI, PasswordWolf and the custom generator, across all five character policies, with 10,000 samples in each cell. Offline times use the zxcvbn fast-hash scenario of 10¹⁰ guesses per second.

View data table

Length	Median guesses	Mean zxcvbn score	Median offline time
8	10⁸	2.0	0.01 s
12	10¹²	4.0	100 s
20	10²⁰	4.0	about 317 years

Approach

Python analysis of generated samples using zxcvbn estimates and descriptive character-frequency statistics, aggregated by generator, character policy and length.

What the results establish

The saved aggregate dataset contains 45 comparison groups totalling 450,000 samples. Length dominated: every generator and policy scored about 2 of 4 at 8 characters and 4 of 4 from 12 characters. One detail stood out. zxcvbn raised warnings on 10.4% of Bitwarden's 8-character symbols-and-digits samples, against under 0.5% for the other generators. The analysis explores estimated strength and recurring patterns, rather than measuring real-world password cracking.

Limitations and lessons

Reviewing my own work surfaced a discrepancy. The report names secrets.choice, while the saved custom generator uses Python's random module, which is not designed for cryptographic use. A correct build uses secrets. The comparison also does not establish that a custom generator is safer than a password manager.

More case studies

All projects

Flutter
Flask

SilverWard: scam detection for seniors

A prototype that helps seniors check suspicious messages. I built the Flutter app and the web app, where a language model returns a scam likelihood with three plain-language reasons from a typed message or a camera image.

Read case study

Endpoint security
YARA

Beyond signature-based detection

Explored the limitations of YARA-based detection and researched NodLink, a provenance-graph approach to detecting suspicious system activity.

Read case study

Security & usability
User study

Guided secure network design

Co-authored a study examining how lightweight guidance influenced participants' security and usability decisions when designing a simulated SME network.

Read case study