I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially dismissive until I tried it out. I spend some time trying to write a strong password using these resources:

http://wpengine.com/support/strong-passwords/ https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/

I understand now that the system allows for easier to remember yet harder to guess passwords however it took me a very long time to come up with a password. I was able to set a very long password quickly, but to get something which is easy to remember it took me dozens of tries, which is fine for me, but my clients are not going to accept that.

I understand that WordPress is only making suggestions about the strength of the password but in my case I have strong passwords enforced via a plugin and I would prefer to keep this setting, and of course the idea with this is to increase security, but ironically if I can't figure out a system for creating passwords which works with the checker I will be faced with the prospect of turning off the strong password enforce setting.

Are there any guidelines to be able to set a password in a short number of tries, ideally something that I could use to educate my clients. In traditional password checkers, the end user knew how to achieve a strong password by following a set of rules ( eg > 8 chars, one capital, one number, one symbol, not username, etc )

Edit: It was pointed out in the comments that the zxcvbn system is used outside of WordPress, eg Drupal; so this question could be asked eg on StackOverflow, but I tested the ratings from the official zxcvbn tester demo and I couldn't find any correlation between the results and the messages "weak", "medium", "strong" etc. https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html

How does WordPress interpret and use the rankings from zxcvbn?

Edit 2: I discovered what the relationship is between the zxcvbn software and the WordPress messages, which effectively answers the question, to some degree anyway, so I've added this as an answer.

  • 2
    xkcd.com/936 – Howdy_McGee Mar 20 '15 at 1:51
  • what have we come to :0 – byronyasgur Mar 20 '15 at 2:18
  • As always it's good to explain downvotes or they don't really count for much do they? :-) – byronyasgur Mar 20 '15 at 21:19

A phrase consiting of words separated by spaces ("apples ocean barbarians") can be easy to remember and type, yet strong due to the number of characters. Such a password works on WP, but not all web apps will accept this method.

  • thanks ... yes but if I give that information to a client and they try, say as I did, a slight variation, which they might even see as an improvement ... eg apples ocean salmon fish it comes up as weak, so it's not communicable really – byronyasgur Mar 20 '15 at 2:11
  • all these are weak or very weak ... apples ocean variable, apples ocean system bell, apples ocean yellow stranger, apples ocean excellent idea – byronyasgur Mar 20 '15 at 2:14
  • apples ocean yellow stranger, for example, shows centuries with the tester you posted in your answer, seems good to me @byronyasgur – Nicolai Mar 20 '15 at 21:01

this is really not related to wordpress, but since it is already have an upvoted answer I might as well add mine....

For most people strong passwords are not required. I am using a soft password for many services I don't care much about and so far my accounts haven't been hacked (AFAIK of course ;) ). Strong passwords are needed to deflect a targeted attack, but you probably don't need them to deflect random login attempt if you just have a medium strength password. To deflect random login attempt it might be much better to have some login rate limiting, maybe once a second, long enough so slow down an attack but short enough for a human not to notice it at all.

And then you need to ask yourself if the only attack vector is via random login attempts to the server. If it is a very strong password but you don't have SSL what will prevent from the starbucks (replace with any other place with free wifi) admin to locate it in the traffic log?

In other words, the strength of the password should reflect some risk assessment of its likelihood to be attacked and the damage that can be caused if it is discovered. Instead of requiring your users to have strong passwords maybe you should consult them about their perceived risk, or just let them decide for themselves instead of forcing them.

The rule of thumb in wordpress should be that there should be only one admin user with a strong password, users should never login as admin unless they have to actually mess with the code or global settings, and all the rest of the users should be with restricted capabilities so even if they are hacked the damage that can be caused is very localised (edits to the content but no ability for code modification) an maybe some audit process like displaying to the user the last IP from which he was logged in.

  • While I'm sure your method seems to work well for you, I have my own system which has worked perfectly up to now. I gave you a downvote because from what I can tell you're not answering the question at all ... unless you're saying that I CANT enforce strong passwords. Are you? If not do you have a suggestion for how to communicate a method to create them to clients? – byronyasgur Mar 20 '15 at 14:13
  • I am saying that the question belongs to the security stack not to the wordpress one. You can force strong passwords and make the users hate you without providing any actual additional security because in the real world there are very little successful attacks based on dictionary password attacks. Hackers exploit security weaknesses in your code or do a social based targeted attacks against specific people (or not specific using phishing) and against both strong passwords by themseelf are less likely to work. You might prefer to use SSO or two factor authentication. – Mark Kaplun Mar 20 '15 at 16:41
  • Mark I think this has nothing to do with security ... it might be UI/UX but even if it is; regardless it's WordPress UI/UX. I just want to know how to use the password checker. If it's there it stands to reason that it should be usable, but I haven't figured out how to use it. Whether strong passwords are enforced or not is irrelevant because the end user should be able to achieve a strong password regardless; otherwise the checker serves no purpose. Also BTW I have tons of other security stuff in place, strong passwords are only a small part of it, but one I'd like to keep preferably. – byronyasgur Mar 20 '15 at 17:02
  • This is the core of your question - "Are there any guidelines to be able to set a password in a short number of tries, ideally something that I could use to educate my clients." and it has nothing to do with wordpress code. Maybe you intended to ask something else... – Mark Kaplun Mar 20 '15 at 19:21
  • I see in the help that I can ask questions about plugin and theme development but I don't see anywhere stating explicitly that the questions need to be specifically about code, but please point it out if it's there. Also I'm not certain that the answer to this question wouldn't include code even if that was the case; to be honest I doubt that I'll get what I need from this without some modification to the theme or by creating a custom plugin, but it makes more sense to ask if there's a human way around it first. – byronyasgur Mar 20 '15 at 19:46

The zxcvbn software does not use any standardised rules in the way that a traditional password checker does, but the zxcvbn tester's score rating of 0 to 4 maps to the WordPress ratings as shown below; so from this it should be possible to use the official tester to test out and practice creating the types of passwords which will achieve a "strong" rating, and from that gather information to educate clients on this new method of password creation.

0 => very weak
1 => very weak
2 => weak
3 => medium
4 => strong


The checker on this page carries the data from the zxcvbn tester as well as the visual colours from the WordPress tester, so could be helpful for non technical people, as they'd need to achieve a rating of 5 on this tester to qualify as "strong" in the WordPress tester.

  • Down votes should ideally be accompanied by explanations. As the one who asked the question I can say that this does answer my question. It's also well phrased and formatted unless I'm mistaken so it doesn't make any sense to me how someone else can suggest that it didn't answer the question since I'm the one who asked it ... but if I'm mistaken and there's actually a logical reason for the down votes why not share this information properly. – byronyasgur Mar 21 '15 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.