[This isn't even a programming question.](https://stackoverflow.com/q/392928) It's a thinly veiled "what algo should I use to check password strength", which we all known the modern answer to `password.lenght() > 12`. It doesn't offer anything novel and I'm sure guys at Sec.SE would tore this apart and make an actual good questions about it, like [How can we accurately measure a password entropy range?](https://security.stackexchange.com/q/4630/27973) and [How reliable is a password strength checker?](https://security.stackexchange.com/q/2687/27973). No information on this question follows reasonable security practices and misinforms users that this is a acceptable practice.

PS. if you measure password strength by other than length, I implore you to stop those practices and remember [xkcd 936](https://xkcd.com/936/).