# What is NBP?

NIST Bad Passwords, or NBP, aims to help make the reuse of common passwords a thing of the past. With the release of Special Publication 800-63-3: Digital Authentication Guidelines, it is now recommended to blacklist common passwords from being used in account registrations.

NBP is intended for quick client-side validation of common passwords only. It is still advisable to check server side if the password is not common.

From Naked Security @ Sophos:

> Check new passwords against a dictionary of known-bad choices. You don’t want to let people use ChangeMe, thisisapassword, yankees, and so on.

# Demo

#### Your password is not common.

#### This demo uses SecList's 1,000,000 most common password list.

# Usage

Using NBP is easy. Simply include the library in your registration page and place the collections folder in the same folder as the registration page. If you wish, you may specify a customs collections folder. Your folder structure should look like this:

The collections folder refers to the folder storing the compiled most common passwords. In default installations, is the folder containing mostcommon_*, i.e. mostcommon_100000

    webroot/
    ├── css/
    ├── js/
    |   ├── nbp/
    |       ├── nbp.min.js
    ├── collections/
        ├── mostcommon_100000
        ├── ...
    ├── index.php
    ├── register.php

## API Usage

### Initalization

- Function signature

    NBP.init([collection_name = "mostcommon_10000"] [, collection_folder_path = "collections/"] [, cache = true]);

- Example

    NBP.init("mostcommon_100000", "register/nbpcollections/", true);

### Check common password

- Function signature

    NBP.isCommonPassword(password);

- Example

    NBP.isCommonPassword('hunter2');

# Password list sources

NBP comes with password lists sourced from SecLists by Daniel Miessler.

The inbuilt lists include:

- mostcommon_100
- mostcommon_500
- mostcommon_1000
- mostcommon_10000
- mostcommon_100000

Building your own password lists is as easy:

Your list should be in the following format, i.e. separated by new lines:

    password1
    password2
    ....
    hunter2

Your list_out name must follow this format: [listname]_[list_count], i.e. my_custom_list_600

    # Assuming pwd is git root

    cd build_collection

    node index.js raw_list_in list_out

    mv list_out ../collections/.

# Implementation details

NBP uses a bloom filter to store lists in a more compact format. The filter implementation can be found at cry/jsbloom.

LZString is used to compress raw bloom filter contents to UTF-16.

The bloom filter contents are cached in localStorage in order to avoid unnecessary downloads in order to improve user experience.