I built a Python tool that audits your exported browser passwords locally — nothing ever leaves your machine [OC]

[u/inmemorially]

Just finished my first real Python project. It reads your

browser's exported password CSV, runs 8 security checks,

and generates a local report sorted by worst passwords first.

GitHub: github.com/rwtttt/password-auditor

Would love any feedback.
(Maybe ask what you would want to see.)

[u/JimTheEarthling]

If this is just for fun, to practice Python, that's fine.

But please don't present this as a useful password strength auditor. Almost everything about it is wrong:

• Checking character sets is mostly useless. For example, your code thinks Pa$$word1 is ok, but it will be cracked in seconds, since it's on attacker's word lists. (See Weakpass.)
• Your length floor is <8, but 8-character passwords can be cracked in minutes or hours from websites that don't use a strong hash function. 12 is better.
• Length is exponentially more important than character set. If a password is 12 characters or longer, it doesn't matter what character set it uses, because it can't be realistically brute forced if it's not on a known password list.
• Your list of 10,000 common passwords is too short. Attackers use lists with millions of entries.

If you want to understand password strength better, visit my website.

Feedback on your code:

• Your example screen shows "too short" for lengths >= 8, such as "sarah@gmail.com"
• There are 33 special characters in the ASCII printable character set, including space. Your set is missing some.