Enhancing Password Security Through a High-Accuracy Scoring Framework Using Random Forests
Traditional password strength evaluators rely on static, rule-based heuristics and thus fail to detect prevalent weak password patterns (e.g., “P@ssw0rd1!”), fostering users’ false sense of security. To address this, we propose a novel random forest–based password strength scoring framework that jointly models Leet-normalized Shannon entropy, keyboard-layout traversal features, and character-level TF-IDF weighted n-grams—thereby capturing fine-grained semantic and behavioral weaknesses. We conduct a systematic empirical evaluation on a large-scale real-world password dataset, comparing our approach against SVM, CNN, and logistic regression baselines. Our model achieves 99.12% classification accuracy while maintaining strong interpretability. Crucially, it generates concrete, actionable security recommendations—e.g., specific character substitutions or length extensions—enabling practical, user-centric improvements. This advances the state of the art in both predictive performance and operational utility for real-world password security assessment.