Score difference in zxcvbn4j and zxcvbn-ts

[parashartarun]

We already have zxcvbn-ts on our UX layer, now we are implementing it in backend and tried to use zxcvbn4j /nbvcxz java libraries . Now problem is we are getting different score from UI and backend. Please help in understanding:

• Is there any other java equivalent of zxcvbn-ts
• How can we bring parity.
• Any other suggestions

cc: @MrWook @SamR1

[MrWook]

Hey,

I understand your use case, and I'll do my best to answer your questions:

• Is there any other Java equivalent of zxcvbn-ts?
  I recommend nbvcxz for a Java implementation. The author is active and has a solid understanding of this topic. The main difference between this Java port and zxcvbn-ts is that nbvcxz was implemented before the original library switched from an entropy-based approach to a guessCount approach. Therefore, nbvcxz is based on entropy, while zxcvbn-ts is based on guessCount, leading to different results. At least as i remembere

• How can we bring parity?
  The only way to achieve parity would be to create a zxcvbn organization and maintain a repository for each supported language, ensuring consistent features and algorithms across all implementations. This would include publishing the dictionaries used, which could then be shared across languages. However, this is a significant undertaking and would require more than one person.

• Any other suggestions?
  I recommend sticking to one version of zxcvbn, either the Java port or the TypeScript port. If you need to validate password strength on the backend, use the Java port and make debounced API requests to validate the password and return the score. If backend validation is not necessary, use the zxcvbn-ts library.