Click here to Skip to main content
Email Password   helpLost your password?

Screenshot - GooglePasswordStrength.gif

Introduction

Do you have an iGoogle Account? Well, if you are like the rest of the world that use the Internet, you will have, which also means that you have seen the very cool (and useful) "Password strength" control.

This control has a very intelligent API to determine if the password you entered is any good. It is "intelligent" in the fact that it does not just check that you have a password that is larger than six characters; e.g., a password "aaaaaaaaaaaa" will come out as "Weak", "my password" as "Good", and "grty3657DF?£hr4" as (yes you guessed it!) "Strong".

The big secret is this is actually a public API from Google, to which you can pass a password and it will return the password strength from 1 (least secure) to 4 (most secure). You can view it here.

And here is the "but", there is no interface for the control and it is not openly advertised by Google.

Background

When I found a use for such a control on a website I'm currently building, I first looked at the Microsoft AJAX Toolkit. At first, this worked great; however, I felt that the algorithm used was not as strong as the Google one, and I kept on getting JavaScript errors due to that control.

Bring on this control.

Using the code

The easiest way is to add a reference to the GooglePasswordStrength.dll, then add a section into the web.config:

<pages> 
    <controls> 
        <add tagPrefix="google" namespace="GooglePasswordStrength" 
             assembly="GooglePasswordStrength"/> 
    </controls> 
</pages>

Then, add the control to your page, and attach it to an asp:TextBox.

<table> 
    <tr> 
        <td><asp:TextBox ID="txtPassword" runat="server" /></td>
        <td><google:PasswordStrength ID="PS" 
                TargetControlID="txtPassword" 
                CssClass="password" runat="server" /></td>
    </tr> 
</table>

Points of interest

The control utilises AJAX, but does not require any third party AJAX library. However, if your application uses the Microsoft AJAX Library, the control invokes a Client Script Proxy that was written by Rick Strahl to handle all the client scripts.

Known issues

The XMLHttpRequest makes a call to the Google Password Strength API directly, so some browser settings may cause a "Permission Denied" error. This is because the XMLHttpRequest is making a call to a page outside of the local domain. In Microsoft Internet Explorer, you can change this setting under the Security Custom Level settings. Look for "Miscellaneous -> Access data sources across domains".

For a more robust, permanent solution, you will need to change the call to a page on the same domain and make a WebRequest to the Google API from there.

Update

  1. In the GooglePasswordStrength.Web Project, create a new WebForm called GetPassword.aspx.
  2. In GetPassword.aspx, delete all the lines except the @Page directive line.
  3. Open GetPassword.aspx.cs.
  4. In the Page_Load method, add the following code:
  5. string passwd = Request.QueryString["Passwd"];
    
    string GUrl = string.Format("https://www.google.com/" + 
                  "accounts/RatePassword?Passwd={0}", passwd);
    
    WebRequest webRequest = WebRequest.Create(GUrl);
    WebResponse webResponse = webRequest.GetResponse();
    StreamReader reader = new StreamReader(webResponse.GetResponseStream());
    
    Response.Clear();
    Response.Output.Write(reader.ReadToEnd());
    Response.End();
  6. Open PasswordStrength.js.
  7. On line 76, there is the xmlHttpObj.open method. Replace "https://www.google.com/accounts/RatePassword?Passwd=" with "GetPassword.aspx?Passwd=".
  8. Also, in the PasswordStrength.js file, replace all instances of "innerText" with "innerHTML" (I later found out that innerText is IE only).

Now, the XmlHttpRequestObject will make a call to a file on the same domain, and you will no longer get the security error.

History

You must Sign In to use this message board.
 
 
Per page   
 FirstPrevNext
GeneralDoes PasswordStrength Control have Multilingual support ?
Thy.Maverick
19:08 18 Nov '09  
I want to know if the control's bevahiour can be altered such that it displays the messages in languages other than english. And I am talking about the message's that are automatically displayed as per the setting specified for MinimumNumericCharacters, MinimumSymbolCharacters properties.

I am able to translate the tests in TextStrengthDescriptions property.
GeneralProblem when the control is invisible on page load
dc99
2:40 17 Apr '09  
Just in case anyone else sees this problem.

If the control is not on the page when it loads and then you use ajax to make it (or the panel it's in) visible, the webresources won't have been registered. This is because the prerender won't run on the page load, and trying to insert thes resources into the page later fails.

The solution I found was to move the registers into the OnLoad:



protected override void OnLoad(EventArgs e)
{
string scriptUrl = ClientScriptProxy.Current.GetWebResourceUrl(this, GetType(), "GooglePasswordStrength.PasswordStrength.js");
ClientScriptProxy.Current.RegisterClientScriptInclude(this, GetType(), "GPasswordStrength", scriptUrl);

HtmlLink styleLink = new HtmlLink();
styleLink.Href = ClientScriptProxy.Current.GetWebResourceUrl(this, GetType(), "GooglePasswordStrength.PasswordStrength.css");
styleLink.Attributes.Add("rel", "stylesheet");
styleLink.Attributes.Add("type", "text/css");
Page.Header.Controls.Add(styleLink);

base.OnLoad(e);
}

protected override void OnPreRender(EventArgs e)
{

string startScript = string.Format("var {0}_jsControl = new PasswordStrengthControl('{0}');{0}_jsControl.initialize('{1}');", ID, TargetControl!=null ? TargetControl.ClientID : String.Empty);
ClientScriptProxy.Current.RegisterStartupScript(this, GetType(), "PasswordStrengthControl_initialize", startScript, true);

base.OnPreRender(e);
}


There might be flaws in this approach but it fixes my problem
GeneralProblem using Login and CreateUserWizard controls
Member 1258236
5:45 23 Jan '09  
Hello i have a problem using your control together with a Login and a CreateUserWizard control as both of them use a password control with the same ID "Password" and TargetControlID property gets the id of the wrong one (login control). Do you have any idea to help me to resolve this problem in a smart way?
thank you
Manlio
GeneralCannot register the DLL
Bhavna Vij
4:35 6 Aug '08  
Hi,
I am not able to register DLL. It says "THE DLL WAS LOADED BUT THE DLL ENTRY POINT WAS NOT FOUND. DLL COULD NOT BE REGISTERED."

Please help,
Bhavna
GeneralRe: Cannot register the DLL
Roger Chapman
6:16 6 Aug '08  
In your project first remove your current reference to the dll. Make sure you place the dll in a folder within your solution (on the file structure), e.g. a "SharedLibs" folder.

Re-add the ref to this dll in your SharedLibs folder. ReBuild Solution.

If this does not work...close VS and reopen.

This is a VS problem and not the dll.

Regards,

Rodj
QuestionOk, I am doing some things incorrectly obvioulsy...
topdog50
11:31 18 Jul '08  
Hello,

Thank you for your work here. I am very interested in implementing this in my application but I am having difficulty getting it to work within my ASP.NET application. I am obviously getting something confused and hope that you would be kind enough to help me through it.

I want to install this in a page called "SignUp.aspx" using VS 2005 and C# as code-behind. So far, I have taken the following steps:

1) Downloaded Version 2 and the source code
2) Placed these in a directory called "C:\ClassLibraries\PasswordMeter"
3) I added the reference to "GooglePasswordStrength.Web.dll" and "GooglePasswordStrength.dll" to my bin folder in my web page.
4) I added "<add tagPrefix="google" namespace="GooglePasswordStrength" assembly="GooglePasswordStrength"/>" to my web.config
5) Added the control to the page
6) Run the application, control displays correctly but when I begin typing passwords, the control does not respond.

I failed to assemble the plumbing correctly somewhere.

Help?

Phil
AnswerRe: Ok, I am doing some things incorrectly obvioulsy...
Roger Chapman
23:27 20 Jul '08  
Hi Phil,

You only need to reference the GooglePasswordStrength.dll in your application. The likely problem is that you need to add the extra code in your application outlined in the "update" section, due to the security issue of IE.

In the version 2 download there is an example application which shows you exactly what you need.

If you still get stuck, publish the page and I'll take a look to see what you are missing.

Regards,

Rog.
QuestionChecking the strength
wes lowe
4:55 19 Jun '08  
I'm looking at using this in an asp.net app I'm writing.
Is there anyway I can check the strength of a password on the page call back to allow me to enable the submit button when a good/strong password is entered?

Any help would be appreciated.

Cheers

Wes
AnswerRe: Checking the strength
Roger Chapman
5:05 19 Jun '08  
Hi Wes,

The short answer is yes, however you will have to use Google API directly in your code behind.

This API does an AJAX call, which is just the same code as if you did check the password on the postback.

In the "Update" section above, you should see the code that gets called. The StreamReader will return a number between 1 and 4 (I think...it's been awhile since I looked at it), which indicates the strength of the password.

Hope this helps, let me know if you get stuck.

UPDATE:

Actually...having thought about it further, you could just add some code to the PasswordStrength.js file to enable the submit button when the return from the ajax call equals 4.
QuestionRe: Checking the strength
wes lowe
5:42 19 Jun '08  
Enabling the submit button in the javascript seems like the best approach.
I'm really a winforms developer and this is my first attempt at asp.net. I'm sturggling to get my head around javascript.


case '4':
CurrentParent._leftBar.className = 'leftBar4';
CurrentParent._rightBar.className = 'rightBar4';
CurrentParent._text.className = 'text4';
CurrentParent._text.innerHTML = 'Strong';

var SubmitButton = document.getElementById("btnChangePassword");
SubmitButton.Enabled = true;

break;


As you can see I've placed the code in the case statement.
This doesn't seem to enable the button though, is there something more I need to do, or am I just doing something stupid?

Thanks again for your help!

Wes
AnswerRe: Checking the strength
Roger Chapman
5:55 19 Jun '08  
You're almost there....

HTML Elements do not have and "Enabled" attribute, but they do have a "disabled" attribute.

Remember that you will have to put a disabled attribute on the submit button in the first place. Are you using an ASP.NET Button control? If you are you must add this attribute in your code behind on load. Also ASP.NET Buttons may have a different Id when rendered on the client compared to the .NET Id attribute. You may need to use: document.getElementById("<%=btnChangePassword.ClientID%>");

Let me know how you get on.
GeneralRe: Checking the strength
wes lowe
6:26 19 Jun '08  
I've finally got there.
I was using an ASP.NET button and I just couldn't get it to work, so I dropped a normal HTML button on and got it working straight away, looked at the compiled code in script explorer, and saw it modifying the siabled attribute.
Tried again with the ASP.NET button and still nothing but I did notice it was setting the disabled attribute correctly, then I realised that I still had the Buttons Enabled property set to false, removed that and it started working.

Thanks for all your help, I feel a little more confident with JavaScript as well now.

Wes
GeneralHave a bug..
rodrigosor
17:33 10 Jun '08  
If you put a latin char lik 'ç' in textbox the same does not work.....
att
rodrigo reis
rod@rsoreis.com

----
att
Rodrigo Reis

AnswerRe: Have a bug..
Roger Chapman
23:13 10 Jun '08  
This is not a bug within this API, but with Google... nothing I can control.
GeneralGoogle Password Strength API - demo2 not working
Leelavathy
6:14 22 May '08  
Hi,

I have tried your tool and it was just what i was looking for.
with version demo i did get the 'permission denied' error then changed the browser settings and as you said and it worked just fine.
then reset my browser used the demo_2 version but this time nothing was changing with the Password strength that is

when normally we enter any thing in the Password box your tool would start off like too short, then weak ans so on
but with demo_2 the bar is still grey(no msg of whether weak, strong is shown) even if i have typed 20 char in the textbox

Please help!!
AnswerRe: Google Password Strength API - demo2 not working
Roger Chapman
6:25 22 May '08  
Sounds like the AJAX request is not getting a correct response from the server.
I would look at the net traffic to see what the response of the call is bringing back. You can use Firebug (in Firefox) or Fiddler in IE. Let me know how you get on....if you really can't figure it out publish the page (or demo of it) so that I can take a look.

Regards,

Roger.
GeneralRe: Google Password Strength API - demo2 not working
Leelavathy
5:49 23 May '08  
Cannot see anything in fiddler and sorry dont know how to publish the page.
I want to use this API coz other codes available are javascript and i'm using a web control.
Help me!!
AnswerRe: Google Password Strength API - demo2 not working
Roger Chapman
7:26 23 May '08  
I can't help if I don't know what the problem is!

The only way is that you zip up all the whole solution and place it somewhere I can download it...for example Windows Live SkyDrive on a shared folder.

I will have a look and see if I can fix your problem.

Regards,

Rodj.
Questioni could not run your control
Ehsan Golkar
3:20 28 Sep '07  
Hi, thanks for your control

i used VS2005 but when add your control and used i could not see any event in "Password Strength " any changed !?

and please help me : i wanted to learn how to create ajax control in asp.net

thanks so much
AnswerRe: i could not run your control
Roger Chapman
3:26 28 Sep '07  
Have you tried running the sample application?
In order to register the control on your page you must add it to the web.config
What Event are you looking for?
GeneralRe: i could not run your control
Ehsan Golkar
10:55 28 Sep '07  
hi, of course but get this warning when enter any charachter " This page is accessing information that in not under its,control, this pages a security risk, do you want to continiue ?" and when i click yes o no could not saw any effect in your "password Strength"
thanks if you help me to run your enjoy controlSmile
GeneralRe: i could not run your control
Roger Chapman
0:10 1 Oct '07  
Hi Ehsan,

Please check out my "Known Issues" section at the bottom of the article.
I did not have time to sort out the security issues for accessing information outside of the app domain. But you can easily sort this problem by changing the XmlHttpRequest Object on the client (in JavaScript) to call a local *.aspx page, with the code behind of that page make a HttpWebRequest then pass back the results to the client.
Hope this help, let me know how you get on.
AnswerRe: i could not run your control
Ehsan Golkar
20:40 1 Oct '07  
hi thanks for your answer, i changed my security IE but no changed
I saw befor page , could you saw my and help me ?
my page imge is in http://b.1asphost.com/Favour/GoogleStrength.jpg[^]


thanks so much
AnswerRe: i could not run your control
Roger Chapman
23:36 1 Oct '07  
Hi Ehsan,

Looks like the ajax call is not being fired at all....are you getting any JavaScript errors?

I know this sounds silly, but you do have JavaScript enabled, right? (sorry had to ask).

It is a bit hard to see the problem with just a screen shot...can you put this on a demo site for me to have a look at the source code and test?
Generali m having problem
goodonebond
22:25 8 Aug '07  
i have tried to add GooglePasswordStrength.dll as reference in vb.net asp.net 2003 but it says its not a valid assembly or com component as well as its not a micrososft.net modlue


Last Updated 9 Nov 2007 | Advertise | Privacy | Terms of Use | Copyright © CodeProject, 1999-2010