Account Checker

Purpose & User Intent: account checker fn provides privacy-respecting assessment of credential health across multiple accounts. It helps individuals and SMB IT teams identify weak passwords, credential reuse, and exposure risk without attempting to log in to services. Users supply a list of accounts (minimum: username or email, domain) and may include passwords for strength checks. The tool returns risk indicators, policy flags, and remediation guidance to reduce compromise risk across SaaS and development environments.
Core Logic & Features: Required: accounts list; Optional/advanced: breach lookup via anonymized hashing, password strength scoring, reuse detection, policy checks; Outputs: risk_score (0-100), breach_match (boolean), reused_accounts (array of account ids), policy_violations, remediation_tips; Privacy: no login attempts, in-session processing.
Inputs & Outputs: Inputs: accounts[] with fields id, username_or_email, domain, password (optional). Sample: {'id':'a1','username_or_email':'[email protected]','domain':'example.com','password':'P@ssw0rd!'}; Validation: non-empty id, valid email or username; domain format; password length 8-64; Outputs: JSON payload; risk_score numeric 0-100; breach_match boolean; reused_accounts string[]; policy_violations string[]; formatting rules: arrays contain identifiers; numbers use 0-100.
Algorithms & Calculations: Strength score computed via entropy-based heuristic; breach checks performed against anonymized hash queries; reuse detection compares normalized credential tokens across accounts; domain-aware checks enforce common service password rules; final risk_score is a weighted combination: 0.5*strength + 0.3*(breach?100:0) + 0.2*(reuse?50:0).
Error & Edge Cases: Invalid or missing required inputs trigger validation errors; extremely large inputs trigger chunked processing or throttling; breach data downtime lowers checks to safe defaults; malformed domains or emails produce targeted warnings; results remain in-session and not persisted unless exported.
Industry/Region & Localization: Aligns with NIST SP 800-63B for password guidance; GDPR data minimization; supports locale-aware date/time in reports; time zones and formats configurable; currencies and localization of terms not applicable.
Assumptions & Exclusions: Assumes user-provided identifiers reflect real accounts; does not perform login attempts or API calls to services; not a password reset tool; not a full security posture audit; does not guarantee breach coverage; data is not stored beyond the user session unless explicitly exported.