Upcoming changes in the Plesk Password Strength Policy

Violet Altukhova

Updated February 01, 2024 10:20

DoNotDelete:docref kb: how-to

Question

What was changed in the Plesk Password Strength Policy since 2022?

Answer

To comply with the current security standards (like 1Password generator), the password validation functionality in Plesk was revised and improved significantly.

The new validation feature is enabled by default starting from July 5th, 2022 (Obsidian 18.0.45 release)

Warning: If the automatic 3rd-party scripts manage Plesk with CLI or API, it is needed to check that the new validator accepts the passwords generated by them. Otherwise, domains/subscriptions would not be created due to the password strength validation failure.

The new validation feature was delivered in the disabled state in Plesk Obsidian 18.0.43 (April 12th). In order to test it before it is implemented it could be enabled by specifying the following panel.ini option:

CONFIG_TEXT: [passwordManagement]estimator = zxcvbn

For customers, who use automatic scripts for subscriptions/customers creation the new API 1038 error code was added. This error code will be returned to a 3rd-party system if a used password was not accepted by Plesk so it will be possible to reinitiate the password generation process.

It means that customers with a such scenario can update their scripts to reinitiate a password generation and validation process if the previous password was not accepted.

Plesk Password Strength Policy

**Levels of strength**
Very Weak	No protection	"Too guessable"
Weak	Modest protection from throttled online attacks	"Very guessable"
Medium	Modest protection from unthrottled online attacks	"Somewhat guessable"
Strong	Modest protection from offline attacks assuming a slow hash function (like bcrypt, scrypt, PBKDF2, argon)	"Safely unguessable"
Very Strong	Strong protection from offline attacks assuming a slow hash function (like bcrypt, scrypt, PBKDF2, argon)	"Very unguessable"

Time to crack

Plesk uses a 3rd-party open-source solution to identify the password strength. The solution could be checked at:
https://zxcvbn-ts.github.io/zxcvbn/demo/
The used default password strength level can be checked at:
https://github.com/zxcvbn-ts/zxcvbn/blob/49708e2a5cce6ae58958256d56e3918412ead865/packages/libraries/main/src/TimeEstimates.ts#L65-L86

**Estimated crack time**
Entropy	Number of passwords	Time to crack
Entropy	Number of passwords	online, throttled(100 / hour)	online, unthrottled(10 / second)	offline, slow hash(10k / second)	offline, fast hash(10B / second)
8.0 bits	2.56e+02	12.8 hours	12.8 seconds	0.0 seconds	0.0 seconds
10.0 bits	1.02e+03	2.1 days	51.2 seconds	0.1 seconds	0.0 seconds
12.0 bits	4.10e+03	8.5 days	3.4 minutes	0.2 seconds	0.0 seconds
14.0 bits	1.64e+04	34.1 days	13.7 minutes	0.8 seconds	0.0 seconds
16.0 bits	6.55e+04	136.5 days	54.6 minutes	3.3 seconds	0.0 seconds
18.0 bits	2.62e+05	1.50e+00 years	3.6 hours	13.1 seconds	0.0 seconds
20.0 bits	1.05e+06	5.98e+00 years	14.6 hours	52.4 seconds	0.0 seconds
22.0 bits	4.19e+06	2.39e+01 years	2.4 days	3.5 minutes	0.0 seconds
24.0 bits	1.68e+07	9.57e+01 years	9.7 days	14.0 minutes	0.0 seconds
26.0 bits	6.71e+07	3.83e+02 years	38.8 days	55.9 minutes	0.0 seconds
28.0 bits	2.68e+08	1.53e+03 years	155.3 days	3.7 hours	0.0 seconds
30.0 bits	1.07e+09	6.12e+03 years	1.70e+00 years	14.9 hours	0.1 seconds
32.0 bits	4.29e+09	2.45e+04 years	6.80e+00 years	2.5 days	0.2 seconds
34.0 bits	1.72e+10	9.80e+04 years	2.72e+01 years	9.9 days	0.9 seconds
36.0 bits	6.87e+10	3.92e+05 years	1.09e+02 years	39.8 days	3.4 seconds
38.0 bits	2.75e+11	1.57e+06 years	4.36e+02 years	159.1 days	13.7 seconds
40.0 bits	1.10e+12	6.27e+06 years	1.74e+03 years	1.74e+00 years	55.0 seconds
42.0 bits	4.40e+12	2.51e+07 years	6.97e+03 years	6.97e+00 years	3.7 minutes
44.0 bits	1.76e+13	1.00e+08 years	2.79e+04 years	2.79e+01 years	14.7 minutes
46.0 bits	7.04e+13	4.01e+08 years	1.11e+05 years	1.11e+02 years	58.6 minutes
48.0 bits	2.81e+14	1.61e+09 years	4.46e+05 years	4.46e+02 years	3.9 hours
50.0 bits	1.13e+15	6.42e+09 years	1.78e+06 years	1.78e+03 years	15.6 hours
52.0 bits	4.50e+15	2.57e+10 years	7.14e+06 years	7.14e+03 years	2.6 days
54.0 bits	1.80e+16	1.03e+11 years	2.85e+07 years	2.85e+04 years	10.4 days
56.0 bits	7.21e+16	4.11e+11 years	1.14e+08 years	1.14e+05 years	41.7 days
58.0 bits	2.88e+17	1.64e+12 years	4.57e+08 years	4.57e+05 years	166.8 days
60.0 bits	1.15e+18	6.58e+12 years	1.83e+09 years	1.83e+06 years	1.83e+00 years
62.0 bits	4.61e+18	2.63e+13 years	7.31e+09 years	7.31e+06 years	7.31e+00 years
64.0 bits	1.84e+19	1.05e+14 years	2.92e+10 years	2.92e+07 years	2.92e+01 years