react-hook-hibp

React Hook for password input validation based on Justin Hall's hibp based on Troy Hunt's Have I been pwned?

Demo

Description

This module implements NIST password guidelines to be applied to input elements within the body of a functional React Component.

Memorized secrets SHALL be at least 8 characters in length […]

There should no longer be a requirement to have a certain mix of special characters, upper case letters and numbers for a password. […]

Mandatory validation of newly created passwords against a list of commonly-used, expected, or compromised passwords. […]

Source: NIST Digital Identity Guidelines

Installation

yarn add react-hook-hibp

Usage

Example

import React, { useState, useEffect } from 'react'
import { usePasswordCheck } from 'react-hook-hibp'

export default () => {
  const [value, setValue] = useState('')
  const onChange = e => setValue(e.target.value)

  const [statusCode, checkPassword] = usePasswordCheck()
  useEffect(() => checkPassword(value), [value])

  return (
    <>
      <input type="password" value={value} onChange={onChange} />
      <p>{value !== '' && statusCode}</p>
    </>
  )
}

usePasswordCheck()

const [statusCode, checkPassword] = usePasswordCheck(options)

Call checkPassword() on input change, handle form validation according to statusCode.

statusCodes

Key	Description
MIN_LENGTH	Password is too short.
MAX_LENGTH	Password is too long.
WAITING	Waiting for API access for next check.
CHECKING	Checking password
CHECK_FAILED	Checking password failed
PWNED	Password insecure
NOT_PWNED	Password (probably) secure

options

export const defaultOptions = {
  minLength: 8,
  maxLength: 128
}

setRateLimit()

API Rate limiting is being respected and reflected in statusCodes.WAITING. Increase rate limit if you expect concurrent usage by different processes sharing the same IP. Example:

import { setRateLimit } from 'react-hook-hibp'

setRateLimit(3000)

Notes

• k-anonymity: Only the first five characters of the hashed input are submitted to the haveibeenpwned.com range API.

• API results are being cached non-persistently

License

This module is distributed under the MIT License.