"secret secret secret" has basic score 4 (very unguessable) with estimated 130 billion guesses

[eekboom]

That seems completely wrong to me.

At the same time "password password password" gets a score of 1 with estimated 900 thousand guesses.
What is going on here?

Isn't there a check for repeated words at all?

Can I customize the library to handle this better?

[eekboom]

Also basic score of 4, which seems to be completely wrong: "foo bar foo"

[Tostino]

I really need to mark that "basic score" as deprecated. I never should have implemented it when asked, because the original zxcvbn implementation was terrible from the start.

Yes, that is likely the score, because the implementation of basic score is really stupid.

Here is the output for your initial example from the console... found to be quite insecure.

Commands: estimate password (e); generate password (g); quit (q)
Please enter your command:
e
Please enter the password to estimate:
secret secret secret
----------------------------------------------------------
Time to calculate: 6 ms
Password: secret secret secret
Entropy: 26.82761755346432
Your password does not meet the minimum strength requirement.
Warning: This is a very common password.
Suggestion: Add another word or two. Uncommon words are better.
Time to crack: ONLINE_THROTTLED: 1 years
Time to crack: ONLINE_UNTHROTTLED: 2 days
Time to crack: OFFLINE_ARGON2_ID: 1 hours
Time to crack: OFFLINE_BCRYPT_14: 1 hours
Time to crack: OFFLINE_BCRYPT_12: 22 minutes
Time to crack: OFFLINE_BCRYPT_10: 5 minutes
Time to crack: OFFLINE_BCRYPT_8: 1 minutes
Time to crack: OFFLINE_BCRYPT_5: 10 seconds
Time to crack: OFFLINE_SHA512: instant
Time to crack: OFFLINE_SHA1: instant
Time to crack: OFFLINE_MD5: instant
-----------------------------------
Match Type: DictionaryMatch
Entropy: 6.727920454563199
Token: secret
Start Index: 0
End Index: 5
Length: 6
Dictionary: passwords
Dictionary Value: secret
Rank: 106
Length: 6
Leet Substitutions: false
Reversed: false
Distance: 0
-----------------------------------
Match Type: SeparatorMatch
Entropy: 3.3219280948873626
Token:  
Start Index: 6
End Index: 6
Length: 1
-----------------------------------
Match Type: DictionaryMatch
Entropy: 6.727920454563199
Token: secret
Start Index: 7
End Index: 12
Length: 6
Dictionary: passwords
Dictionary Value: secret
Rank: 106
Length: 6
Leet Substitutions: false
Reversed: false
Distance: 0
-----------------------------------
Match Type: SeparatorMatch
Entropy: 3.3219280948873626
Token:  
Start Index: 13
End Index: 13
Length: 1
-----------------------------------
Match Type: DictionaryMatch
Entropy: 6.727920454563199
Token: secret
Start Index: 14
End Index: 19
Length: 6
Dictionary: passwords
Dictionary Value: secret
Rank: 106
Length: 6
Leet Substitutions: false
Reversed: false
Distance: 0

The time-to-crack is really the important metric, along with your hashing algorithm of choice.
It is estimated that an attacker is using hardware they could purchase for roughly $20k usd for the attack by default

    /**
     * @return The default value for hardware cost is 20000 usd.
     */
    public static long getDefaultCrackingHardwareCost()
    {
        return 20000;
    }
        /**
     * This list was compiled in September 2021 using a baseline of what could be bought for roughly $20k usd for the offline attack values.
     * <p>
     * In the case this library is no longer maintained (or you choose to stay on an old version of it), we will scale the existing values by Moore's law.
     *
     * @param crackingHardwareCost the hardware cost (USD) to scale the guesses per second
     * @return The default list of guess types and associated values of guesses per second.
     */
    public static Map<String, Long> getDefaultGuessTypes(Long crackingHardwareCost)
    {
        BigDecimal moores_multiplier = getMooresMultiplier();
        BigDecimal cost_multiplier = BigDecimal.valueOf(crackingHardwareCost).divide(BigDecimal.valueOf(getDefaultCrackingHardwareCost()), 5, RoundingMode.HALF_UP);
        Map<String, Long> guessTypes = new HashMap<>();
        guessTypes.put("OFFLINE_MD5", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(1200000000000L))).longValue());
        guessTypes.put("OFFLINE_SHA1", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(390000000000L))).longValue());
        guessTypes.put("OFFLINE_SHA512", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(5300000000L))).longValue());
        guessTypes.put("OFFLINE_BCRYPT_5", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(4200000L))).longValue());
        guessTypes.put("OFFLINE_BCRYPT_8", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(530303L))).longValue());
        guessTypes.put("OFFLINE_BCRYPT_10", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(132575L))).longValue());
        guessTypes.put("OFFLINE_BCRYPT_12", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(33143L))).longValue());
        guessTypes.put("OFFLINE_BCRYPT_14", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(8285L))).longValue());
        guessTypes.put("OFFLINE_ARGON2_ID", cost_multiplier.multiply(moores_multiplier.multiply(BigDecimal.valueOf(6540L))).longValue());
        guessTypes.put("ONLINE_UNTHROTTLED", 600L);
        guessTypes.put("ONLINE_THROTTLED", 2L);
        return guessTypes;
    }