I tried something similar to this a while back and found that using Shannon entropy, though effective with long strings, failed pretty hard with shorter strings

I tried something similar to this a while back and found that using Shannon entropy, though effective with long strings, failed pretty hard with shorter strings. Lots and lots of false positives. An alternative that worked surprisingly well (though, not without flaws) was to use a password strength checker similar to python's passwordmeter library. POC: https://github.com/red-bin/password_finder https://github.com/red-bin/password_finder