WooCommerce Password Strength

+1. I, too, would like to have the ability to either be able to have the complexity requirements displayed and/or have the ability to configure the complexity requirements in the backend…

The text would have to be simple enough for the average person to understand.

2.5.2 adds extra text explaining this and more feedback for users.

After installing 2.5.2 I did notice a better explanation for the password. The question I have is are we able to change the text? Our client would like to add some text to that for their customers.

I’ve already started getting complaints about this from customers. I’ve just tried it myself and it’s pretty poor from what I’ve tested. In my testing I found that adding an extra character would convert a strong password to a medium one – that is just wrong.

As my first example of a failure case:

1. abasdsdflkj (Weak)
2. abasdsdflkjd (Medium)
3. abasdsdflkjdd (Strong)
4. abasdsdflkjddd (Medium)

Actually in WooCommerce’s defense – it looks like this is just using the WordPress underlying password checker. How WordPress can have such a poor implementation of a password checker amazes me.

Part of that algorithm I believe looks at repeated characters.

Probably to stop people using aaaaaaaaa etc to hit the min character limit.

Thanks for the reply. I really should be writing this on a WordPress bug, but I’m putting it here for now.

I did a quick bit of research on it – I assume WordPress still using the zxcvbn library (https://wptavern.com/ridiculously-smart-password-meter-coming-to-wordpress-3-7) which sounds like an excellent implementation of a password checker.

But even with me knowing the various password schemes, I found it really hard / opaque to understand what you need to do to your current password to make it stronger.

It rejects this password ‘easythereforeaccept’ (19 characters) long as weak. It still rejects it as weak if users do their standard of adding an exclamation mark, so ‘easythereforeaccept!’.

That is a mixed password of 20 characters which is getting rejected.

I know the standard of adding an exclamation isn’t good practice, but effectively banning all existing practices makes it really frustrating.

Of course if people know the XKCD that this is based on then they can add in spaces to get ‘easy therefore accept!’ and that is suddenly strong. But no normal person knows that.

I understand we want to improve people’s passwords, but it seems we’ve just created another frustrating password checker with rules that are even harder to figure out.