> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Password Strength Check

> Password Strength Check using the Stytch React SDK

The `strengthCheck` method wraps the [Strength Check](/docs/api-reference/consumer/api/passwords/strength-check) Password API endpoint. This method allows you to check whether or not the user's provided password is valid based on the configuration set in your [Stytch Dashboard](https://stytch.com/dashboard/password-strength-config), and to provide feedback to the user on how to increase the strength of their password. All passwords must pass the strength requirements to be accepted as valid.

## Parameters

<ParamField body="password" type="string" required>
  The password for the user. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characters, etc.
</ParamField>

<ParamField body="email" type="string">
  The email associated with the password. If the email address is included, it will be factored into strength evaluation via our password breach checks. If you do not include the email, it is possible that the strength check response will evaluate as valid – but the password will fail with a weak\_password error when used in the Create password endpoint due to a breach check failure.
</ParamField>

## Response

<ResponseField name="breach_detection_on_create" type="boolean">
  Will return true if breach detection will be evaluated. By default this option is enabled. This option can be disabled in the [dashboard](https://stytch.com/dashboard/password-strength-config#breach-detection). If this value is false then `breached_password` will always be false as well.
</ResponseField>

<ResponseField name="breached_password" type="boolean">
  Returns true if the password has been breached. Powered by [HaveIBeenPwned](https://haveibeenpwned.com/).
</ResponseField>

<ResponseField name="score" type="int">
  The score of the password determined by [zxcvbn](https://github.com/dropbox/zxcvbn). Values will be between 1 and 4, a 3 or greater is required to pass validation.
</ResponseField>

<ResponseField name="strength_policy" type="string">
  The strength policy type enforced, either `zxcvbn` or `luds`.
</ResponseField>

<ResponseField name="valid_password" type="boolean">
  Returns true if the password passes our password validation. We offer two validation options, [zxcvbn](/docs/consumer-auth/authentication/passwords/strength-policy#zxcvbn) is the default option which offers a high level of sophistication. We also offer [LUDS](/docs/consumer-auth/authentication/passwords/strength-policy#luds) which is less sophisticated but easier to understand. If an email address is included in the call we also require that the password hasn't been compromised using built-in breach detection powered by [HaveIBeenPwned](https://haveibeenpwned.com/).
</ResponseField>

<ResponseField name="feedback" type="object">
  Feedback for how to improve the password's strength using [zxcvbn](https://github.com/dropbox/zxcvbn).

  <Expandable title="properties">
    <ResponseField name="suggestions" type="string[] | null">
      The suggestions to display to the user.
    </ResponseField>

    <ResponseField name="warning" type="string | null">
      The warning message to display to the user.
    </ResponseField>

    <ResponseField name="luds_requirements" type="object">
      Contains which LUDS properties are fulfilled by the password and which are missing to convert an invalid password into a valid one. You'll use these fields to provide feedback to the user on how to improve the password.

      <Expandable title="properties">
        <ResponseField name="has_digit" type="boolean">
          Returns true if the password has a digit.
        </ResponseField>

        <ResponseField name="has_lower_case" type="boolean">
          Returns true if the password has a lowercase letter.
        </ResponseField>

        <ResponseField name="has_symbol" type="boolean">
          Returns true if the password has a symbol.
        </ResponseField>

        <ResponseField name="has_upper_case" type="boolean">
          Returns true if the password has an uppercase letter.
        </ResponseField>

        <ResponseField name="missing_characters" type="number">
          Returns the number of characters that the password is missing.
        </ResponseField>

        <ResponseField name="missing_complexity" type="number">
          Returns the number of complexity requirements that the password is missing.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="request_id" type="string">
  Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
  may ask for this value to help identify a specific API call when helping you debug an issue.
</ResponseField>

<ResponseField name="status_code" type="number">
  The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
  equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.
</ResponseField>

<Panel>
  <RequestExample>
    ```jsx theme={null}
    import { useCallback } from 'react';
    import { useStytch } from '@stytch/react';

    export const Login = () => {
    const stytch = useStytch();

    const strengthCheck = useCallback(() => {
      stytch.passwords.strengthCheck({
        email: '${exampleEmail}',
        password: '${examplePassword}',
      });
    }, [stytch]);

    return <button onClick={strengthCheck}>Strength Check</button>;
    };
    ```
  </RequestExample>

  <ResponseExample>
    ```json 200 - LUDS invalid theme={null}
    {
        "breach_detection_on_create": true,
        "breached_password": false,
        "feedback": {
          "suggestions": null,
          "warning": null,
          "luds_requirements": {
            "has_digit": true,
            "has_lower_case": false,
            "has_symbol": false,
            "has_upper_case": false,
            "missing_characters": 6,
            "missing_complexity": 1
          }
        },
        "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
        "score": 0,
        "status_code": 200,
        "strength_policy": "luds",
        "valid_password": false
    }
    ```

    ```json 200 - LUDS valid theme={null}
    {
        "breach_detection_on_create": true,
        "breached_password": false,
        "feedback": {
          "suggestions": null,
          "warning": null,
          "luds_requirements": {
            "has_digit": true,
            "has_lower_case": true,
            "has_symbol": true,
            "has_upper_case": true,
            "missing_characters": 0,
            "missing_complexity": 0
          }
        },
        "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
        "score": 0,
        "status_code": 200,
        "strength_policy": "luds",
        "valid_password": true
    }
    ```

    ```json 200 - zxcvbn invalid theme={null}
    {
        "breach_detection_on_create": true,
        "breached_password": false,
        "feedback": {
          "luds_requirements": null,
          "suggestions": [
            "Add another word or two. Uncommon words are better."
          ],
          "warning": "This is a top-100 common password."
        },
        "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
        "score": 0,
        "status_code": 200,
        "strength_policy": "zxcvbn",
        "valid_password": false
    }
    ```

    ```json 200 - zxcvbn valid theme={null}
    {
        "breach_detection_on_create": true,
        "breached_password": false,
        "feedback": {
          "luds_requirements": null,
          "suggestions": [],
          "warning": null
        },
        "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
        "score": 4,
        "status_code": 200,
        "strength_policy": "zxcvbn",
        "valid_password": true
    }
    ```

    ```json 500 - Failure theme={null}
    {
      "status_code": 500,
      "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
      "error_type": "internal_server_error",
      "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
      "error_url": "https://stytch.com/docs/api/errors/500"
    }
    ```
  </ResponseExample>
</Panel>