Password Strength Score

[rootberg]

Is there a way to get the password strength score on the server side? I know that I could just populate a hidden text box with the score and have is posted back to the server, but I was wondering if there was a more elegant solution.

[Vasil]

Hello rootberg,

The strength score is calculated only ClientSide. So your solution with the hidden field is maybe the clearest and easiest one.

Kind regards,
Vasil
the Telerik team

[Michael]

Then what's to stop someone from bypassing a minimum strength requirement by altering the value of the hidden field? Client-side only validation is dangerous business - the values are too easy to manipulate.

[Vasil]

Hello Michael,

This is not validation method of the RadTextBox, it is only indicator, to notify the users if their password is good(safe) enough.

To validate the password you should use asp:CustomValidator or asp:RegularExpressionValidator, or to perform some additional server side validation.

All the best,
Vasil
the Telerik team

[liu]

hello,
how telerik calculate the Strength of password? where i can get info? 
for example telerik pu score 10% what does it mean? like less 10 caractest or there is no uppercase caracters? 
var calculatedScore = args.get_strengthScore(); --> how it get this score?


https://www.telerik.com/forums/password-strength-score
https://docs.telerik.com/devtools/aspnet-ajax/controls/textbox/features/password-strength-checker

<script type="text/javascript">
    function CalculatingStrength(sender, args) {
        if (args.get_passwordText() == "Enter Password") {
            //Manually set strength Score depending on the input text.
            args.set_indicatorText("Custom text");
            args.set_strengthScore(0);
        }
        else {
            var calculatedScore = args.get_strengthScore();
            //Changing the indicator text depending on the calculated score.
            args.set_indicatorText("Score: (" + calculatedScore + "/100)");
        }
    }
</script>

[Doncho]

Hi Liu,

The score is calculated respecting the values set in the CalclulationWeightings property. By default the weightings are length=50%; numeric=15%; casing=15%; symbol=20%.

CalculationWeightings - List of 4 semicolon-separated numeric values used to determine the weighting of a strength characteristic. The total of the 4 values should be 100. The default they are defined as 50;15;15;20. This means that password length will determine the 50% of the strength calculation, Numeric criteria is 15% of strength calculation, casing criteria is 15% of calculation, and symbol criteria is 20% of the calculation. So the format is "A;B;C;D" where A = length weighting, B = numeric weighting, C = casing weighting, D = symbol weighting.

You can find more information in the About this demo section in our live demo - TextBox - Password Strength Checker. You can also play around changing the password strength settings to get a better feeling of the resulting strength in percent.

I hope that will prove helpful!

Kind regards,
Doncho
Progress Telerik

[liu]

thank you very much for answer