Password strength cannot reliably be measured by looking at a password. To take one common trick: is VpttrvyJptdrNsyyrtu a strong password? It looks pretty oka

Password strength cannot reliably be measured by looking at a password. To take one common trick: is VpttrvyJptdrNsyyrtu a strong password? It looks pretty okay, definitely less of a pattern than CatName1985, and an estimator like zxcvbn might also not know that it's just CorrectHorseBattery offset by one character on a qwerty keyboard. Now that you know this, you can start to guess my other passwords. Would you still say it is strong now? What if I'm not the only person on the planet using this trick, does that affect it? The strength calculator you're looking for is (technically) the method of generating the password. If you generate 6 random words on a dictionary size of 15'000, that's log(15e3⁶, 2)≃83 bits of entropy. You can only know this by asking the user how they came up with the password, or by telling them to do it a certain way. The rest is just guessing, though I will say that something like zxcvbn does a surprisingly good job at it. The caveat is that the generating method should not have any plausible chance of overlapping with other (insecure) in-use methods. E.g., if you roll a die between zero and a hundred quadrillion and use that as password, most of the time you'll roll a really long number. But if you roll 123123 or 12345678 and use that as password, you can expect it to be cracked. Technically, by excluding "weak" choices from the list of possible values, you are reducing the strength of the password because there are fewer remaining valid guesses, but given how attacks actually work, it makes sense to do this.