How often should I change my passwords?

Current best practice is to change passwords only when there's evidence of compromise or when using a weak password. Regular forced changes often lead to weaker, predictable passwords. Focus on using strong, unique passwords and enable two-factor authentication instead.

JavaScript Password Analyzer:

class PasswordStrengthChecker {
  constructor() {
    this.commonPasswords = [
      'password', '123456', 'password123', 'admin', 'qwerty',
      'letmein', 'welcome', 'monkey', '1234567890', 'dragon',
      'football', 'iloveyou', 'master', 'sunshine', 'princess'
    ];
    
    this.keyboardPatterns = [
      'qwerty', 'asdf', 'zxcv', '1234', '4321',
      'qwertyuiop', 'asdfghjkl', 'zxcvbnm'
    ];
    
    this.sequentialPatterns = [
      'abc', '123', 'xyz', 'fed', '321', 'cba'
    ];
  }
  
  // Main password analysis function
  analyzePassword(password) {
    if (!password || typeof password !== 'string') {
      return {
        success: false,
        error: 'Password must be a non-empty string'
      };
    }
    
    const startTime = performance.now();
    
    // Basic metrics
    const length = password.length;
    const hasLower = /[a-z]/.test(password);
    const hasUpper = /[A-Z]/.test(password);
    const hasNumbers = /[0-9]/.test(password);
    const hasSymbols = /[^a-zA-Z0-9]/.test(password);
    
    // Character set analysis
    const charSets = this.analyzeCharacterSets(password);
    
    // Entropy calculation
    const entropy = this.calculateEntropy(password, charSets);
    
    // Pattern analysis
    const patterns = this.analyzePatterns(password);
    
    // Strength calculation
    const strengthScore = this.calculateStrengthScore({
      length,
      hasLower,
      hasUpper,
      hasNumbers,
      hasSymbols,
      entropy,
      patterns
    });
    
    // Time to crack estimation
    const crackTime = this.estimateCrackTime(entropy);
    
    // Recommendations
    const recommendations = this.generateRecommendations({
      length,
      hasLower,
      hasUpper,
      hasNumbers,
      hasSymbols,
      patterns,
      strengthScore
    });
    
    const endTime = performance.now();
    
    return {
      success: true,
      password: this.maskPassword(password),
      analysis: {
        length: length,
        characterSets: charSets,
        composition: {
          hasLowercase: hasLower,
          hasUppercase: hasUpper,
          hasNumbers: hasNumbers,
          hasSymbols: hasSymbols,
          uniqueCharacters: new Set(password).size
        },
        entropy: {
          bits: Math.round(entropy * 100) / 100,
          quality: this.getEntropyQuality(entropy)
        },
        patterns: patterns,
        strength: {
          score: strengthScore,
          percentage: Math.round(strengthScore),
          level: this.getStrengthLevel(strengthScore),
          color: this.getStrengthColor(strengthScore)
        },
        crackTime: crackTime,
        recommendations: recommendations
      },
      timing: {
        duration: Math.round(endTime - startTime),
        formatted: `${Math.round(endTime - startTime)}ms`
      }
    };
  }
  
  // Analyze character sets used
  analyzeCharacterSets(password) {
    const sets = {
      lowercase: 0,
      uppercase: 0,
      numbers: 0,
      symbols: 0,
      total: 0
    };
    
    if (/[a-z]/.test(password)) {
      sets.lowercase = 26;
      sets.total += 26;
    }
    
    if (/[A-Z]/.test(password)) {
      sets.uppercase = 26;
      sets.total += 26;
    }
    
    if (/[0-9]/.test(password)) {
      sets.numbers = 10;
      sets.total += 10;
    }
    
    if (/[^a-zA-Z0-9]/.test(password)) {
      sets.symbols = 32; // Estimate common symbols
      sets.total += 32;
    }
    
    return sets;
  }
  
  // Calculate password entropy
  calculateEntropy(password, charSets) {
    if (charSets.total === 0) return 0;
    
    // Basic entropy: log2(charset^length)
    const basicEntropy = password.length * Math.log2(charSets.total);
    
    // Adjust for patterns and repetition
    const repetitionPenalty = this.calculateRepetitionPenalty(password);
    const patternPenalty = this.calculatePatternPenalty(password);
    
    const adjustedEntropy = basicEntropy * (1 - repetitionPenalty) * (1 - patternPenalty);
    
    return Math.max(0, adjustedEntropy);
  }
  
  // Calculate repetition penalty
  calculateRepetitionPenalty(password) {
    const charCount = {};
    for (const char of password) {
      charCount[char] = (charCount[char] || 0) + 1;
    }
    
    const maxRepetition = Math.max(...Object.values(charCount));
    const totalChars = password.length;
    
    // Higher penalty for more repetition
    return Math.min(0.5, (maxRepetition - 1) / totalChars);
  }
  
  // Calculate pattern penalty
  calculatePatternPenalty(password) {
    const lowerPassword = password.toLowerCase();
    let penalty = 0;
    
    // Check for keyboard patterns
    for (const pattern of this.keyboardPatterns) {
      if (lowerPassword.includes(pattern)) {
        penalty += 0.1;
      }
    }
    
    // Check for sequential patterns
    for (const pattern of this.sequentialPatterns) {
      if (lowerPassword.includes(pattern)) {
        penalty += 0.1;
      }
    }
    
    // Check for repeated sequences
    for (let i = 2; i <= Math.floor(password.length / 2); i++) {
      const substring = password.substring(0, i);
      if (password.includes(substring.repeat(2))) {
        penalty += 0.2;
      }
    }
    
    return Math.min(0.8, penalty);
  }
  
  // Analyze password patterns
  analyzePatterns(password) {
    const lowerPassword = password.toLowerCase();
    
    return {
      isCommonPassword: this.commonPasswords.includes(lowerPassword),
      hasKeyboardPatterns: this.keyboardPatterns.some(pattern => 
        lowerPassword.includes(pattern)),
      hasSequentialPatterns: this.sequentialPatterns.some(pattern => 
        lowerPassword.includes(pattern)),
      hasRepeatedChars: this.hasRepeatedCharacters(password),
      hasDatePattern: /(19|20)d{2}/.test(password),
      hasRepeatedSequences: this.detectRepeatedSequences(password),
      isAllSameCase: password === password.toLowerCase() || 
                   password === password.toUpperCase(),
      hasPersonalInfo: this.detectPersonalInfo(password)
    };
  }
  
  // Check for repeated characters (like aaa or 111)
  hasRepeatedCharacters(password) {
    for (let i = 0; i < password.length - 2; i++) {
      if (password[i] === password[i + 1] && password[i] === password[i + 2]) {
        return true;
      }
    }
    return false;
  }

  // Detect repeated sequences
  detectRepeatedSequences(password) {
    for (let i = 2; i <= Math.floor(password.length / 2); i++) {
      const substring = password.substring(0, i);
      if (password.includes(substring.repeat(2))) {
        return true;
      }
    }
    return false;
  }
  
  // Detect potential personal information
  detectPersonalInfo(password) {
    const personalPatterns = [
      /(admin|user|guest)/i,
      /(john|jane|mike|sarah|david|maria)/i,
      /(gmail|yahoo|hotmail)/i,
      /@/
    ];
    
    return personalPatterns.some(pattern => pattern.test(password));
  }
  
  // Calculate overall strength score (0-100)
  calculateStrengthScore(analysis) {
    let score = 0;
    
    // Length scoring (0-30 points)
    if (analysis.length >= 16) score += 30;
    else if (analysis.length >= 12) score += 25;
    else if (analysis.length >= 8) score += 20;
    else if (analysis.length >= 6) score += 10;
    else score += 5;
    
    // Character variety (0-30 points)
    let varietyScore = 0;
    if (analysis.hasLower) varietyScore += 5;
    if (analysis.hasUpper) varietyScore += 5;
    if (analysis.hasNumbers) varietyScore += 10;
    if (analysis.hasSymbols) varietyScore += 10;
    score += varietyScore;
    
    // Entropy bonus (0-25 points)
    if (analysis.entropy >= 60) score += 25;
    else if (analysis.entropy >= 40) score += 20;
    else if (analysis.entropy >= 30) score += 15;
    else if (analysis.entropy >= 20) score += 10;
    else score += 5;
    
    // Pattern penalties (0-15 points deducted)
    let penalties = 0;
    if (analysis.patterns.isCommonPassword) penalties += 15;
    if (analysis.patterns.hasKeyboardPatterns) penalties += 10;
    if (analysis.patterns.hasSequentialPatterns) penalties += 8;
    if (analysis.patterns.hasRepeatedChars) penalties += 5;
    if (analysis.patterns.hasDatePattern) penalties += 3;
    if (analysis.patterns.hasRepeatedSequences) penalties += 10;
    if (analysis.patterns.isAllSameCase) penalties += 5;
    if (analysis.patterns.hasPersonalInfo) penalties += 8;
    
    score -= penalties;
    
    return Math.max(0, Math.min(100, score));
  }
  
  // Get strength level description
  getStrengthLevel(score) {
    if (score >= 80) return 'Very Strong';
    if (score >= 60) return 'Strong';
    if (score >= 40) return 'Moderate';
    if (score >= 20) return 'Weak';
    return 'Very Weak';
  }
  
  // Get strength color
  getStrengthColor(score) {
    if (score >= 80) return 'green';
    if (score >= 60) return 'blue';
    if (score >= 40) return 'yellow';
    if (score >= 20) return 'orange';
    return 'red';
  }
  
  // Get entropy quality description
  getEntropyQuality(entropy) {
    if (entropy >= 60) return 'Excellent';
    if (entropy >= 40) return 'Good';
    if (entropy >= 30) return 'Fair';
    if (entropy >= 20) return 'Poor';
    return 'Very Poor';
  }
  
  // Estimate time to crack password
  estimateCrackTime(entropy) {
    // Assume 1 billion guesses per second (modern hardware)
    const guessesPerSecond = 1e9;
    const totalCombinations = Math.pow(2, entropy);
    const avgTime = totalCombinations / (2 * guessesPerSecond);
    
    return {
      seconds: avgTime,
      readable: this.formatTime(avgTime),
      security: this.getSecurityLevel(avgTime)
    };
  }
  
  // Format time in readable format
  formatTime(seconds) {
    if (seconds < 60) return 'Less than 1 minute';
    if (seconds < 3600) return `${Math.round(seconds / 60)} minutes`;
    if (seconds < 86400) return `${Math.round(seconds / 3600)} hours`;
    if (seconds < 2592000) return `${Math.round(seconds / 86400)} days`;
    if (seconds < 31557600) return `${Math.round(seconds / 2592000)} months`;
    if (seconds < 315576000) return `${Math.round(seconds / 31557600)} years`;
    if (seconds < 3155760000) return `${Math.round(seconds / 315576000)} decades`;
    return 'Centuries or longer';
  }
  
  // Get security level based on crack time
  getSecurityLevel(seconds) {
    if (seconds < 3600) return 'Insecure';
    if (seconds < 86400) return 'Very Low';
    if (seconds < 2592000) return 'Low';
    if (seconds < 31557600) return 'Moderate';
    if (seconds < 315576000) return 'High';
    return 'Very High';
  }
  
  // Generate recommendations for improvement
  generateRecommendations(analysis) {
    const recommendations = [];
    
    if (analysis.length < 12) {
      recommendations.push({
        type: 'length',
        priority: 'high',
        message: 'Increase password length to at least 12 characters'
      });
    }
    
    if (!analysis.hasLower) {
      recommendations.push({
        type: 'lowercase',
        priority: 'medium',
        message: 'Add lowercase letters (a-z)'
      });
    }
    
    if (!analysis.hasUpper) {
      recommendations.push({
        type: 'uppercase',
        priority: 'medium',
        message: 'Add uppercase letters (A-Z)'
      });
    }
    
    if (!analysis.hasNumbers) {
      recommendations.push({
        type: 'numbers',
        priority: 'medium',
        message: 'Add numbers (0-9)'
      });
    }
    
    if (!analysis.hasSymbols) {
      recommendations.push({
        type: 'symbols',
        priority: 'high',
        message: 'Add special characters (!@#$%^&*)'
      });
    }
    
    if (analysis.patterns.isCommonPassword) {
      recommendations.push({
        type: 'common',
        priority: 'critical',
        message: 'Avoid common passwords - use something unique'
      });
    }
    
    if (analysis.patterns.hasKeyboardPatterns) {
      recommendations.push({
        type: 'keyboard',
        priority: 'high',
        message: 'Avoid keyboard patterns like "qwerty" or "asdf"'
      });
    }
    
    if (analysis.patterns.hasSequentialPatterns) {
      recommendations.push({
        type: 'sequential',
        priority: 'high',
        message: 'Avoid sequential patterns like "123" or "abc"'
      });
    }
    
    if (analysis.patterns.hasRepeatedChars) {
      recommendations.push({
        type: 'repetition',
        priority: 'medium',
        message: 'Avoid repeated characters like "aaa" or "111"'
      });
    }
    
    if (analysis.patterns.hasPersonalInfo) {
      recommendations.push({
        type: 'personal',
        priority: 'high',
        message: 'Avoid personal information in passwords'
      });
    }
    
    if (analysis.strengthScore < 60) {
      recommendations.push({
        type: 'general',
        priority: 'high',
        message: 'Consider using a password manager for strong, unique passwords'
      });
    }
    
    return recommendations;
  }
  
  // Generate strong password suggestions
  generateStrongPassword(length = 16, includeSymbols = true) {
    const lowercase = 'abcdefghijklmnopqrstuvwxyz';
    const uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
    const numbers = '0123456789';
    const symbols = includeSymbols ? '!@#$%^&*()_+-=[]{}|;:,.<>?' : '';
    
    const allChars = lowercase + uppercase + numbers + symbols;
    let password = '';
    
    // Ensure at least one character from each set
    password += lowercase[Math.floor(Math.random() * lowercase.length)];
    password += uppercase[Math.floor(Math.random() * uppercase.length)];
    password += numbers[Math.floor(Math.random() * numbers.length)];
    if (includeSymbols) {
      password += symbols[Math.floor(Math.random() * symbols.length)];
    }
    
    // Fill remaining length with random characters
    for (let i = password.length; i < length; i++) {
      password += allChars[Math.floor(Math.random() * allChars.length)];
    }
    
    // Shuffle the password
    return password.split('').sort(() => Math.random() - 0.5).join('');
  }
  
  // Generate memorable passphrase
  generatePassphrase(wordCount = 4) {
    const words = [
      'apple', 'bridge', 'castle', 'dream', 'eagle', 'forest',
      'guitar', 'house', 'island', 'jungle', 'kitchen', 'laptop',
      'mountain', 'ocean', 'planet', 'rainbow', 'sunset', 'tiger',
      'umbrella', 'village', 'window', 'yellow', 'zebra', 'adventure'
    ];
    
    const selectedWords = [];
    for (let i = 0; i < wordCount; i++) {
      const randomIndex = Math.floor(Math.random() * words.length);
      selectedWords.push(words[randomIndex]);
    }
    
    return selectedWords.join('-');
  }
  
  // Mask password for display
  maskPassword(password) {
    if (password.length <= 4) return '*'.repeat(password.length);
    return password.substring(0, 2) + '*'.repeat(password.length - 4) + 
           password.substring(password.length - 2);
  }
  
  // Batch analyze multiple passwords
  analyzeMultiplePasswords(passwords) {
    const results = [];
    
    for (const password of passwords) {
      const analysis = this.analyzePassword(password);
      results.push(analysis);
    }
    
    return {
      success: true,
      count: passwords.length,
      results: results,
      summary: this.generateBatchSummary(results)
    };
  }
  
  // Generate summary for batch analysis
  generateBatchSummary(results) {
    const successful = results.filter(r => r.success);
    const strengthLevels = {
      'Very Strong': 0,
      'Strong': 0,
      'Moderate': 0,
      'Weak': 0,
      'Very Weak': 0
    };
    
    successful.forEach(result => {
      const level = result.analysis.strength.level;
      strengthLevels[level]++;
    });
    
    const avgScore = successful.reduce((sum, r) => 
      sum + r.analysis.strength.score, 0) / successful.length;
    
    return {
      totalPasswords: results.length,
      successful: successful.length,
      averageStrength: Math.round(avgScore),
      distribution: strengthLevels,
      recommendation: avgScore >= 60 ? 
        'Overall good password security' : 
        'Consider improving password strength'
    };
  }
}

// Usage examples
const checker = new PasswordStrengthChecker();

// Analyze password strength
console.log('Password Analysis:');
const password = 'MySecure!Pass123';
const analysis = checker.analyzePassword(password);
console.log(analysis);

// Generate strong password
console.log('\nGenerate Strong Password:');
const strongPassword = checker.generateStrongPassword(16, true);
console.log('Generated:', strongPassword);

// Analyze generated password
const generatedAnalysis = checker.analyzePassword(strongPassword);
console.log('Strength:', generatedAnalysis.analysis.strength);

console.log('\nGenerate Passphrase:');
const passphrase = checker.generatePassphrase(4);
console.log('Passphrase:', passphrase);

// Analyze passphrase
const passphraseAnalysis = checker.analyzePassword(passphrase);
console.log('Passphrase Strength:', passphraseAnalysis.analysis.strength);

console.log('Password strength checker ready!');