Tthey do not measure entropy (very good point about measuring entropy here: http://codereview.stackexchange.com/questions/868/calculating-entropy-of-a-string/87

Tthey do not measure entropy (very good point about measuring entropy here: http://codereview.stackexchange.com/questions/868/calculating-entropy-of-a-string/878#878 http://codereview.stackexchange.com/questions/868/calculatin...), but just check that password conforms to several simple rules. So, yes, "2tcUKstR" (which I've just generated with `openssl rand -base64 6`) is considered less secure than "Aa1!!". Well, the good thing that they're just suggesting about password's quality, not enforcing it. It really pissed me off when one site declined to accept password and said it was "insecure" just because I was using base64, and (by chance) password did not contain any non-alphanumeric characters. I've also seen another site which rejected "/" in passwords, insisting on /^[A-Za-z0-9]$/ only.