I built a 3KB alternative to replace zxcvbn (389KB) without detection loss

Description and use

Passcore is a 3 KB password strength estimator that replaces the 389 KB zxcvbn library without losing detection accuracy. It loads faster, evaluates passwords quicker, and improves Core Web Vitals scores.

Problem

zxcvbn, the most widely used password strength estimator, is 389 KB gzipped, unmaintained since 2017, and adds noticeable load time to registration pages, hurting UX and conversion.

Outcome

passcore delivers the same 98.4 % detection rate as zxcvbn while shrinking the bundle size by 130×, speeding up load and evaluation times, and improving Core Web Vitals scores.

Workflow

• 1. Install passcore via npm: npm i passcorelib.
• 2. Import the library: import { passcore } from 'passcorelib';.
• 3. Replace zxcvbn calls: const { score } = passcore(password);.
• 4. Update UI to use the returned score and warning fields.
• 5. Test on existing forms to ensure functionality and UX remain unchanged.

Evidence

passcore loads in ~0.2 ms. It evaluates a password in ~2,600 nanoseconds.

Source

98.4% detection rate on real breach data, same as zxcvbn.

Source