Fine by me to revert for the given reason.

Having this on the server side makes sense to me, see eg #49821, which would enable nice password migration strategies.

It'd be great to figure out a working algo/lib that could work both on the frontend and on the backend.

@weaverryan spotted this lib, which looks quite simple to port to PHP:
https://github.com/deanilvincent/check-password-strength/blob/master/index.js

Note that instead of reverting, we would happily accept a PR that replaces the implementation.

ping @Spomky FYI

Hi,

OK I understand the problem here.
What I can propose is to create an interface used by the validator. This will allow developpers to use zxcvbn-php or any other implementation. WDYT?

I think we need this to work out-of-the-box with a properly maintained reference implementation anyway :)

The lib is in bad maintenance state so I'm not sure we need to make it easy to use it. Also, options are specific to each password checkers so I'm not sure we can have this abstraction.

Also some core members argued that this feature could be better handled on the frontend i.e. rewritten as a UX component or a cookbook example.

Regarding this, I am preparing a stimulus component to show the strength while typing the password.
But is it sufficient on client side? I think the submitted password should be verified by the application.

And if it's frontend, we need to find a maintained alternative.

There is a modern TypeScript rewrite: https://github.com/zxcvbn-ts/zxcvbn

I think we need this to work out-of-the-box with a properly maintained reference implementation anyway :)

As a symfony/* component or maybe I could handle this in a new repository I own

As a symfony/* component

Fine by me as long as you maintain it :)

What I find problematic with zxcvbn is that it requires to generate large sets of data (up to MBs, depending on the locales used in the app).

I like @nicolas-grekas idea to port this JS library to PHP (it's just a few lines of code and it could be enough for most apps):

@weaverryan spotted this lib, which looks quite simple to port to PHP:
https://github.com/deanilvincent/check-password-strength/blob/master/index.js

OK I get it now.
My proposal:

• A new PR that uses most of the previous logic (in particular the constraint object)
• A new interface|null injected to the validator constructor (let say StrengthEstimatorInterface)
• A basic strength estimator that implements StrengthEstimatorInterface and used by default (I will check the link shared by @javiereguiluz)
• For the framework bundle, an option to define another strength estimator
• For the tests, we could also have a mock

Fine by me as long as you maintain it :)

@chalasr yes! In paralell, I will work on a side project based on the typescript implementation shared by @jdreesen.
It will also implement the StrengthEstimatorInterface so that anyone could use it in place of the basic one.

I like the idea! I was thinking about similar as well 😁

If we really want to make the implementation swappable, I'd suggest using a closure instead of adding an interface.

Alternative: #49856. Please close this one once it is ready