/
Contact usSee pricingStart building
    Overview
    Changelog
    Installation

    Pre-built UI

    StytchB2B
      Configuration
      Callbacks
      Text Customization
      Component Playground
    Admin Portal
      SSO
      Org Settings
      Member Management
      SCIM
    B2BIdentityProvider
      Configuration
      UI Callbacks

    Headless

    Organizations
      Get Organization
      Get Organization by Slug
      Update Organization
      Delete Organization
      Get Organization Connected Apps
      Get Organization Connected App
    Members
      Get Member
      Create Member
      Update Member
      Search Members
      Delete Member
      Reactivate Member
      Delete Member Password
      Delete Member MFA Phone Number
      Delete Member MFA TOTP
      Unlink Retired Member Email
      Start Member Email Update
      Update Self
      Delete Self Password
      Delete Self MFA Phone Number
      Delete Self MFA TOTP
      Unlink Retired Self Email
      Start Self Email Update
      Update Member (Deprecated)
      Delete Member MFA Phone Number (Deprecated)
      Get Member Connected Apps
      Get Self Connected Apps
      Revoke Member Connected App
      Revoke Self Connected App
    RBAC
      Is Authorized
      Permissions
    Email Magic Links
      Login or Signup
      Invite
      Authenticate
      Send Discovery Email
      Authenticate Discovery Magic Link
    Email One-time Passcodes (OTPs)
      Login or Signup
      Authenticate OTP
      Send Discovery Email OTP
      Authenticate Discovery Email OTP
    OAuth
      Start OAuth Flow
      Google One Tap
      Authenticate
      Start Discovery OAuth Flow
      Discovery Authenticate
    Session Management
      Get Session
      Authenticate Session
      Revoke Session
      Update Session
      Exchange Session
      Get Tokens
      Revoke Sessions for Member
      Attest Session
      Exchange Access Token
    SSO
      Start SSO Flow
      Authenticate
      Get SSO Connections
      Discover SSO Connections
      Delete SSO Connection
      Create SAML Connection
      Update SAML Connection
      Update SAML Connection by Metadata URL
      Delete Verification Certificate
      Create OIDC Connection
      Update OIDC Connection
      Create External Connection
      Update External Connection
    Discovery
      List Discovered Organizations
      Create Organization via Discovery
      Exchange Intermediate Session
    Passwords
      Authenticate
      Reset by Email Start
      Reset by Email
      Reset by Existing Password
      Reset by Session
      Strength Check
    • Discovery

      • Authenticate
        Reset by Email Start
        Reset by Email
    SCIM
      Create SCIM Connection
      Update SCIM Connection
      Delete SCIM Connection
      Get SCIM Connection
      SCIM Token Rotation Start
      SCIM Token Rotation Complete
      SCIM Token Rotation Cancel
      Get SCIM Connection Groups
    Multi-Factor Authentication
    • One-Time Passcodes

      • SMS Send
        SMS Authenticate
    • Time-Based One-Time Passcodes

      • TOTP Create
        TOTP Authenticate
    • Recovery Codes

      • Recovery Codes Recover
        Rotate Recovery Codes
        Get Recovery Codes
    Impersonation
      Authenticate
    Connected Apps
    • Consent Management

      • Start OAuth Authorization
        Submit OAuth Authorization

    More Resources

    Cookies & session management
    SWR & caching
    TypeScript
Get support on SlackVisit our developer forum

Contact us

B2B SaaS Authentication

/

Frontend SDKs

/

Headless

/

Passwords

/

Strength Check

Strength check

The strengthCheck method wraps the Strength Check Password API endpoint.

This endpoint allows you to check whether or not the Member’s provided password is valid, and to provide feedback to the Member on how to increase the strength of their password.


Method parameters


password* string

The password to authenticate, reset, or set for the first time. Any UTF8 character is allowed, e.g. spaces, emojis, non-English characters, etc.


email_address string

The email address of the Member.


Response fields


request_id string

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.


status_code int

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.


breach_detection_on_create boolean

Will return true if breach detection will be evaluated. By default this option is enabled. This option can be disabled by contacting support@stytch.com. If this value is false then breached_password will always be false as well.


breached_password boolean

Returns true if the password has been breached. Powered by HaveIBeenPwned.


score int

The score of the password determined by zxcvbn. Values will be between 1 and 4, a 3 or greater is required to pass validation.


strength_policy int

The strength policy type enforced, either zxcvbn or luds.


valid_password boolean

Returns true if the password passes our password validation. We offer two validation options, zxcvbn is the default option which offers a high level of sophistication. We also offer LUDS. If an email address is included in the call we also require that the password hasn't been compromised using built-in breach detection powered by HaveIBeenPwned

import React, { useCallback } from 'react';
import { useStytchB2BClient } from '@stytch/react/b2b';

export const StrengthCheck = () => {
  const stytch = useStytchB2BClient();

  const strengthCheck = useCallback(() => {
    stytch.passwords.strengthCheck({
      password: 'xuEvs9sBi8I4x8rCXJPZ',
    });
  }, [stytch]);

  return <button onClick={strengthCheck}>Strength Check</button>;
};
RESPONSE 200 - LUDS invalid
200 - LUDS invalid
​
{
    "breach_detection_on_create": true,
    "breached_password": false,
    "feedback": {
      "suggestions": null,
      "warning": null,
      "luds_requirements": {
        "has_digit": true,
        "has_lower_case": false,
        "has_symbol": false,
        "has_upper_case": false,
        "missing_characters": 6,
        "missing_complexity": 1
      }
    },
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "score": 0,
    "status_code": 200,
    "strength_policy": "luds",
    "valid_password": false
}
RESPONSE 200 - LUDS valid
200 - LUDS invalid
​
{
    "breach_detection_on_create": true,
    "breached_password": false,
    "feedback": {
      "suggestions": null,
      "warning": null,
      "luds_requirements": {
        "has_digit": true,
        "has_lower_case": true,
        "has_symbol": true,
        "has_upper_case": true,
        "missing_characters": 0,
        "missing_complexity": 0
      }
    },
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "score": 0,
    "status_code": 200,
    "strength_policy": "luds",
    "valid_password": true
}
RESPONSE 200 - zxcvbn invalid
200 - LUDS invalid
​
{
    "breach_detection_on_create": true,
    "breached_password": false,
    "feedback": {
      "luds_requirements": null,
      "suggestions": [
        "Add another word or two. Uncommon words are better."
      ],
      "warning": "This is a top-100 common password."
    },
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "score": 0,
    "status_code": 200,
    "strength_policy": "zxcvbn",
    "valid_password": false
}
RESPONSE 200 - zxcvbn valid
200 - LUDS invalid
​
{
    "breach_detection_on_create": true,
    "breached_password": false,
    "feedback": {
      "luds_requirements": null,
      "suggestions": [],
      "warning": null
    },
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "score": 4,
    "status_code": 200,
    "strength_policy": "zxcvbn",
    "valid_password": true
}
RESPONSE 500 - Failure
200 - LUDS invalid
​
{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}