Skip to content

Instantly share code, notes, and snippets.

@tusharhqq

tusharhqq/gist:7d568e309302a42bd6f096bec1077659

Created March 8, 2026 04:42
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save tusharhqq/7d568e309302a42bd6f096bec1077659 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save tusharhqq/7d568e309302a42bd6f096bec1077659 to your computer and use it in GitHub Desktop.
Download ZIP
answer from different ai
Raw
gistfile1.txt
5.4 thinking
Nothing is syntactically wrong with it. This is valid Zod.
The likely issues are behavioral:
1. **No custom error message**
`refine()` will fail with Zod’s default `"Invalid input"` unless you pass a message.
```ts
const schema = z
.string()
.min(3)
.max(30)
.refine((untrustedInput) => {
const result = zxcvbn(untrustedInput);
return result.score > 1;
}, {
message: "Password is too weak",
});
```
2. **`refine` may not run if earlier checks already fail**
If the string is shorter than 3 or longer than 30, Zod may already consider the input invalid, so your `console.log("score", result.score)` might not run for those cases. If you are debugging and not seeing logs, that is often why.
3. **`max(30)` is questionable for passwords**
If this is password validation, limiting to 30 characters is usually a bad idea. Long passwords/passphrases are good.
4. **`score > 1` is a low threshold**
`zxcvbn` scores from 0 to 4.
`> 1` means 2, 3, or 4 pass. Depending on your policy, you may want `>= 3`.
5. **Do not do heavy password-strength checks on every keystroke without care**
If this runs during live form validation, `zxcvbn` can be relatively expensive.
A cleaner version:
```ts
const schema = z
.string()
.min(8, "Must be at least 8 characters")
.max(128, "Must be at most 128 characters")
.refine((value) => zxcvbn(value).score >= 3, {
message: "Password is too weak",
});
```
So the main answer is: **the code itself is valid; the most obvious practical problem is that the refinement has no custom error message, and it may not execute when `.min()` or `.max()` already fail.**
sonet 4.6
Looking at your code, there are two issues:
**1. Missing `async: true` in `.refine()`**
If `zxcvbn` is asynchronous, you need to pass `{ async: true }` as the second argument. But more likely, the real issue is:
**2. The score threshold is too low**
`zxcvbn` scores range from **0 to 4**:
- `0` — Too guessable
- `1` — Very guessable
- `2` — Somewhat guessable
- `3` — Safely unguessable
- `4` — Very unguessable
Your check `result.score > 1` accepts scores **2, 3, and 4**, meaning a "somewhat guessable" password passes. For a meaningful password strength requirement, you likely want:
```js
return result.score >= 3; // or > 2
```
**3. (Minor) `console.log` left in**
The `console.log("score", result.score)` is debug code that should be removed before production.
---
Here's the corrected version:
```js
const schema = z
.string()
.min(3)
.max(30)
.refine(
(untrustedInput) => {
const result = zxcvbn(untrustedInput);
return result.score >= 3;
},
{ message: "Password is too weak" } // optional but recommended
);
```
Also worth noting: a `min(3)` combined with a `zxcvbn` strength check is a bit contradictory — very short passwords will almost never score ≥ 3, so you might consider raising `min` to something like `8` to align with the strength requirement.
google gemini 3.1
import { z } from "zod";
import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';
import * as zxcvbnCommonPackage from '@zxcvbn-ts/language-common';
// Setup zxcvbn (optimizing bundle size)
const options = {
translations: zxcvbnCommonPackage.translations,
graphs: zxcvbnCommonPackage.adjacencyGraphs,
dictionary: {
...zxcvbnCommonPackage.dictionary,
},
};
zxcvbnOptions.setOptions(options);
const schema = z
.string()
// 1. Enforce a reasonable minimum length
.min(8, { message: "Password must be at least 8 characters long" })
// 2. Allow long passphrases (e.g., up to 100 chars)
.max(100, { message: "Password is too long" })
.refine((untrustedInput) => {
const result = zxcvbn(untrustedInput);
// 3. Usually score 3 or 4 is recommended for production
return result.score >= 3;
}, {
// 4. Provide specific feedback
message: "Password is too weak. Try adding more words or special characters."
});
kimi 2.5 thinkig
Looking at this Zod validation code, I can identify several issues:
## 1. **Missing Error Message in `.refine()`**
The `.refine()` method should include a custom error message as the second argument. Without it, users will get a generic "Invalid input" message when the password strength check fails.
```typescript
.refine(
(untrustedInput) => {
const result = zxcvbn(untrustedInput);
return result.score > 1;
},
{ message: "Password is too weak. Please choose a stronger password." } // ← Missing
);
```
## 2. **Performance Concern**
`zxcvbn` is computationally expensive. Since Zod's `refine` runs during validation, this could cause performance issues if:
- Validating many passwords in bulk
- Running on the main thread in a UI (blocking)
- Called repeatedly on every keystroke in a form
## 3. **Missing Type Safety for `zxcvbn`**
The code assumes `zxcvbn` is imported/available but doesn't show the import. Ensure you have:
```typescript
import zxcvbn from "zxcvbn"; // or appropriate import
```
## 4. **Debug `console.log` Left in Production**
The `console.log("score", result.score)` should be removed or guarded for development-only.
## 5. **Hardcoded Score Threshold**
`result.score > 1` is a "magic number." Consider making this configurable or documenting why `1` is the minimum acceptable score (zxcvbn scores 0-4, so this rejects "very guessable" passwords only).
## Improved Version
```typescript
import z from "zod";
import zxcvbn from "zxcvbn";
const MIN_ZXCVBN_SCORE = 2; // 0-4 scale
const schema = z
.string()
.min(3)
.max(30)
.refine(
(password) => {
const result = zxcvbn(password);
return result.score >= MIN_ZXCVBN_SCORE;
},
{
message: "Password is too weak. Try adding more characters, numbers, or symbols.",
// Optional: path for nested error mapping
// path: ["password"],
}
);
```
The **most critical fix** is adding the error message object—without it, validation failures are unhelpful to end users.
grok 4.2 expert
**The code is syntactically correct and will technically work**, but it has several **practical problems** that make it unsuitable for production (especially bad UX and security):
### 1. No custom error message (biggest issue)
When the password fails the `refine` check, Zod throws a generic error:
```ts
{ code: "custom", message: "Invalid input" }
```
Users see nothing useful. You *always* want to tell them why it failed.
### 2. `console.log` left in the validation
This will run **on every validation** (e.g. every keystroke in a form). It spams the browser console in production.
### 3. Way too weak password requirements
- `.min(3)` — completely insecure for passwords.
- `result.score > 1` — accepts score **2** ("somewhat guessable").
zxcvbn scores:
- 0–1 = very weak
- 2 = still weak
- **3–4 = recommended minimum**
### 4. `.refine()` is okay but `.superRefine()` is better
`.superRefine` lets you use zxcvbn’s own `feedback.warning` and `feedback.suggestions`, giving users actually helpful error messages.
### Fixed & improved version (recommended)
```ts
import { z } from "zod";
import zxcvbn from "zxcvbn"; // or better: zxcvbn-ts for tree-shaking
const passwordSchema = z.string()
.min(8, "Password must be at least 8 characters")
.max(128, "Password is too long")
.superRefine((password, ctx) => {
const result = zxcvbn(password); // you can also pass user inputs: zxcvbn(password, [email, username])
if (result.score < 3) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message:
result.feedback.warning ||
result.feedback.suggestions?.[0] ||
"Password is too weak. Try using a longer or more complex password.",
});
}
});
```
This gives clean, user-friendly errors and much stronger security defaults.
Would you like an even more advanced version (e.g. showing all suggestions, async version, or integration with a form library like React Hook Form)?
deepseek deepthinking
The primary issue with the code snippet is that **`zxcvbn` is not imported or defined**. The validation logic relies on this function, but it is missing from the scope. Attempting to run this code would result in a `ReferenceError` because `zxcvbn` is not a globally available function.
Additionally, there are a few other considerations, though not strictly errors:
- The `console.log` inside the `refine` callback will execute on every validation, which might be undesirable for production use.
- For password strength checking, `zxcvbn` can accept an optional second argument (e.g., user-specific data) to improve accuracy. Omitting it is valid but could lead to less precise results.
To fix the code, ensure `zxcvbn` is properly imported (e.g., `import zxcvbn from 'zxcvbn';`).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment