I think it might be useful as a hint but if you're trying to enforce good passwords it falls short like every other scheme. For instance if I'm not mistaken "Pa

I think it might be useful as a hint but if you're trying to enforce good passwords it falls short like every other scheme. For instance if I'm not mistaken "PasswordPassword" would be accepted by your function. I always think there are two ways to look at the password issue: - It's the user's responsibility and you live it up to them not to use something stupidly weak if they value their accounts (at best you can hint them that the password is weak, but if they want to use "qwerty1234" you let them). This is the approach I expect from websites like HN, reddit, and the like. - You want to protect the user and yourself, maybe because you're a website handling money transactions or you're a corporate website and you want to make sure every user has a decent password to access the company's resources etc... In this case the only satisfactory solution is to enforce strong 2FA and if that's really not an option then generate the password for the user. Otherwise they'll always figure out a way to reuse their passwords, generate a weak passwords that passes the predicate etc... Because in the end, while I'm sure most people would agree that "oothe*Nah2phao0t" is a very strong password, what good is it if I reuse it across a large variety of websites? What about phishing and social engineering? I'm going to go out on a limb and guess that there probably are more Facebook account hacked because of password reuse and phishing websites than people blindly guessing passwords.