I used it in ~ 1999-2000 to check password strength in the company I worked for; it was running for 1 minute, for any password that was recovered the owner got

I used it in ~ 1999-2000 to check password strength in the company I worked for; it was running for 1 minute, for any password that was recovered the owner got a notice to change it immediately. Initially 50% of the passwords were the username and more than 50% were up tp 5 characters long. At that time an 8 char min length was "safe enough" for a company that had no sensitive data other than the payroll.