PassHelp.py

"""
PASSHELP MADE BY DotX
Password Strength, Prevalence & Crack-Time Estimator (console)

- Prompts for a password (hidden input)
- Scores weak/medium/strong, shows entropy and suggestions
- Looks up password prevalence in a small demo breach sample
- Estimates average crack time for several attacker speeds
"""
import math
import re
import getpass
from collections import OrderedDict

# -------------------------
# Demo breached-password counts (replace with real data if available)
# -------------------------
SAMPLE_BREACH_COUNTS = {
    "123456":    79014,
    "password":  33001,
    "12345678":  21000,
    "qwerty":    18000,
    "abc123":    16000,
    "123456789": 15000,
    "111111":    14000,
    "1234567":   12000,
    "iloveyou":  11000,
    "adobe123":   9000,
    "P@ssw0rd":   4500,
    "letmein":    4300,
    "monkey":     4100,
    "dragon":     3900,
    "sunshine":   3800,
    "princess":   3600,
    "qwerty123":  3400,
    "welcome":    3200,
    "password1":  3000,
    "admin":      2800
}
TOTAL_SAMPLE = sum(SAMPLE_BREACH_COUNTS.values())

SYMBOLS = r"""~`!@#$%^&*()-_=+[{]}\|;:'",<.>/?"""
SYMBOL_SET_SIZE = len(set(SYMBOLS))

COMMON_PASSWORDS_SET = set(p.lower() for p in [
    "123456","password","123456789","12345678","12345",
    "qwerty","abc123","password1","111111","iloveyou",
    "admin","welcome","letmein","monkey"
])

# -------------------------
# Strength estimation
# -------------------------
def estimate_strength(pw: str):
    if not pw:
        return {"classification":"weak", "bits":0.0, "length":0, "suggestions":["Use a non-empty password or passphrase."]}

    length = len(pw)
    lower_pw = pw.lower()

    # immediate common checks
    if lower_pw in COMMON_PASSWORDS_SET:
        return {
            "classification":"weak",
            "bits":0.0,
            "length": length,
            "suggestions":["Do not use common passwords (e.g. 'password', '123456'). Use a longer, unique passphrase."]
        }

    # detect character classes
    has_lower = bool(re.search(r"[a-z]", pw))
    has_upper = bool(re.search(r"[A-Z]", pw))
    has_digit = bool(re.search(r"[0-9]", pw))
    has_symbol = bool(re.search(r"[^A-Za-z0-9]", pw))

    pool = 0
    if has_lower: pool += 26
    if has_upper: pool += 26
    if has_digit: pool += 10
    if has_symbol: pool += SYMBOL_SET_SIZE
    if pool == 0:
        pool = 1

    bits = length * math.log2(pool)

    # suggestions
    suggestions = []
    if len(set(pw)) == 1:
        suggestions.append("Avoid repeating the same character.")
    if length < 12:
        suggestions.append("Use a longer password (12+ characters) or a multi-word passphrase.")
    if not has_symbol:
        suggestions.append("Add symbols (e.g. !,@,#,$,%) or punctuation.")
    if not has_digit:
        suggestions.append("Add digits.")
    if not has_upper:
        suggestions.append("Mix in uppercase letters.")
    if not has_lower:
        suggestions.append("Mix in lowercase letters.")
    if re.search(r"(0123|1234|2345|3456|4567|5678|6789|7890)", lower_pw) or re.search(r"(abcd|bcde|cdef|defg)", lower_pw):
        suggestions.append("Avoid obvious sequences (e.g., '1234', 'abcd').")
    if re.search(r"(qwerty|asdf|zxcv)", lower_pw):
        suggestions.append("Avoid keyboard patterns like 'qwerty', 'asdf'.")

    # classification with overrides
    if length < 6 or len(set(pw)) == 1 or re.search(r"(012345|123456|abcdef|qwerty)", lower_pw):
        classification = "weak"
    else:
        if bits < 28:
            classification = "weak"
        elif bits < 50:
            classification = "medium"
        else:
            classification = "strong"

    suggestions = list(OrderedDict.fromkeys(suggestions))  # unique, keep order
    if not suggestions:
        suggestions = ["Use a passphrase (three+ unrelated words) or increase length and variety."]

    return {
        "classification": classification,
        "bits": round(bits, 2),
        "length": length,
        "pool_size": pool,
        "suggestions": suggestions
    }

# -------------------------
# Prevalence lookup in the sample dataset
# -------------------------
def lookup_prevalence(pw: str):
    """
    Returns (found:bool, count:int, percent:float)
    Percent is count / TOTAL_SAMPLE * 100
    """
    count = SAMPLE_BREACH_COUNTS.get(pw)
    if count is None:
        count = SAMPLE_BREACH_COUNTS.get(pw.lower())
    if count is None:
        return (False, 0, 0.0)
    percent = (count / TOTAL_SAMPLE) * 100 if TOTAL_SAMPLE > 0 else 0.0
    return (True, count, round(percent, 6))

# -------------------------
# Crack time estimation helpers
# -------------------------
SECONDS_PER_YEAR = 60 * 60 * 24 * 365.0
LOG10_2 = math.log10(2.0)

def estimated_seconds_from_bits(bits: float, guesses_per_second: float):
    """
    Estimate average-case seconds to crack: (2^bits) / (2 * guesses_per_second)
    We'll compute using logs to avoid overflow for large bits.
    Returns a tuple (is_finite_float, value_or_log10)
      - if is_finite_float True: value_or_log10 is actual seconds (float)
      - else: value_or_log10 is log10(seconds)
    """
    if bits <= 0:
        return (True, 0.0)
    # log10(seconds) = (bits - 1) * log10(2) - log10(guesses_per_second)
    log10_seconds = (bits - 1.0) * LOG10_2 - math.log10(guesses_per_second)
    # if it's small enough compute exact float
    if log10_seconds < 15:
        seconds = 10 ** log10_seconds
        return (True, seconds)
    else:
        return (False, log10_seconds)

def format_time_from_seconds_or_log(is_finite, val):
    """
    Format result from estimated_seconds_from_bits.
    If is_finite==True and val is seconds float, provide human-readable.
    If is_finite==False and val is log10(seconds), provide scientific and approximate years.
    """
    if is_finite:
        seconds = val
        if seconds < 1:
            return f"{seconds*1000:.2f} ms"
        if seconds < 60:
            return f"{seconds:.2f} seconds"
        if seconds < 3600:
            return f"{seconds/60:.2f} minutes"
        if seconds < 86400:
            return f"{seconds/3600:.2f} hours"
        if seconds < SECONDS_PER_YEAR:
            return f"{seconds/86400:.2f} days"
        years = seconds / SECONDS_PER_YEAR
        if years < 10000:
            return f"{years:.2f} years"
        # for very large floats, use scientific
        return f"{years:.2e} years"
    else:
        log10_seconds = val
        # convert to years log10
        log10_years = log10_seconds - math.log10(SECONDS_PER_YEAR)
        # give a scientific-style approximation
        years_approx = 10 ** log10_years
        # show as 10^exp if exp large
        exp = int(math.floor(log10_years))
        return f"~1e{exp} years (≈ {years_approx:.2e} years)"

# -------------------------
# Main interactive logic
# -------------------------
def print_banner():
    banner = r"""
    ██████╗ ██╗  ██╗
    ██╔══██╗██║  ██║
    ██████╔╝███████║
    ██╔═══╝ ██╔══██║
    ██║     ██║  ██║
    ╚═╝     ╚═╝  ╚═╝
                   PASSHELP
                 MADE BY DotX
    """
    print(banner)

def main():
    print_banner()
    print("Password Strength, Prevalence & Crack-Time Checker (demo dataset)\n")
    try:
        pw = getpass.getpass("Enter password to check (input hidden): ")
    except (KeyboardInterrupt, EOFError):
        print("\nCancelled.")
        return

    res = estimate_strength(pw)
    found, count, pct = lookup_prevalence(pw)

    print("\nResult:")
    print(f"  Classification : {res['classification'].upper()}")
    print(f"  Length         : {res['length']} characters")
    print(f"  Entropy        : {res['bits']} bits (approx.)")
    if found:
        print(f"  Prevalence     : FOUND in sample dataset — {count} matches, {pct}% of sample (demo data).")
    else:
        # minimal possible percent = 1 / TOTAL_SAMPLE (if one match existed)
        minimal = (1 / TOTAL_SAMPLE * 100) if TOTAL_SAMPLE > 0 else 0.0
        print(f"  Prevalence     : Not found in sample dataset — estimated prevalence in sample: < {minimal:.6f}%")

    # Crack time estimates at multiple speeds
    speeds = [
        ("Slow (online / throttled)", 1e0),        # 1 guess/sec (online throttled)
        ("Script / small GPU rig",      1e6),      # 1e6 guesses/sec
        ("Large GPU rig",               1e9),      # 1e9 guesses/sec
        ("Huge cluster / botnet",       1e12),     # 1e12 guesses/sec
    ]
    print("\nEstimated crack times (average-case, brute-force) :")
    for label, speed in speeds:
        is_finite, val = estimated_seconds_from_bits(res['bits'], speed)
        human = format_time_from_seconds_or_log(is_finite, val)
        print(f"  @ {label:25} ({speed:.0e} g/s): {human}")

    print("\nSuggestions:")
    for s in res["suggestions"]:
        print("   - " + s)

    print("\nNotes:")
    print("  - Crack time estimates assume pure brute-force (worst-case). Real attackers use dictionaries, rules, and GPUs, so predictable passwords may be cracked much faster.")
    print("  - Prevalence data is a small embedded demo sample. Replace with a real breached-password counts CSV for accurate prevalence.")
    print("  - Use a password manager or a long (≥12-20 chars) passphrase for best protection.")

if __name__ == "__main__":
    main()