Better Passwords
Stop use of a bad passwords, including those in the Have I Been Pwned? breached password database
The facts
- Rating
- 5★ from 3
- Active installs
- 200+
- Price
- Free
- Last updated
- 28 Sep 2024
- Added
- Feb 2019
- Requires WP
- 4.0
- Tested up to
- WP 6.6.7
- Requires PHP
- 7.0
- Downloads
- 49,070
Our analysis
AI-assistedBetter Passwords is a WordPress plugin designed to enhance password security by enforcing a minimum length of 10 characters for user passwords. It utilises Troy Hunt’s Pwned Passwords API to check potential passwords against a database of breached passwords while ensuring user privacy by only sending a partial hash. Additionally, it improves password storage security by using modern hashing algorithms such as Bcrypt or Argon2.
This plugin is suitable for WordPress site owners who want to strengthen their site's security without complicating password requirements with complexity rules. It provides a straightforward approach to password management, focusing on length and secure storage.
Best for: WordPress site owners looking to improve password security without enforcing complex requirements.
What it does well
- ✓Sets a minimum password length of 10 characters
- ✓Uses Pwned Passwords API for security checks
- ✓Maintains user privacy by sending only a partial hash
- ✓Upgrades password hashing with Bcrypt or Argon2
Where it falls short
- •Does not enforce complexity rules for passwords
- •Limited information on additional features
Verdict
Better Passwords offers a simple yet effective way to enhance password security by focusing on length and secure storage. It may not suit those who prefer more complex password rules.
From the developer
bettersecurity's own description of Better Passwords, lightly tidied.
This plugin sets a default minimum password length of 10 characters, to ensure that passwords are suitably long that they are hard to guess. However, it does not insist on any complexity rules, such as digits and special characters, as length is the most important thing when making a password hard to guess.
This plugin uses Troy Hunt’s Pwned Passwords API in order to check a user’s potential password against a corpus of breached passwords.
The password itself is never sent to any third party, only a partial hash is sent. This means that the password entered will always be private.
As an added bonus, this plugin also upgrades the hashing algorithm used when storing your password in the database. This is a secure one-way hash created using the Bcrypt or Argon2 algorithm.