The login form usually sends the password in cleartext and it's then hashed on the server-side prior to comparing it to the hash stored in the database. So the

The login form usually sends the password in cleartext and it's then hashed on the server-side prior to comparing it to the hash stored in the database. So they can just determine the password's strength at the time when the user is logging in