Lightweight is an understatement here. A client's project (with not necessarily technical customers) has had pretty reasonable success using the Dropbox origin

Lightweight is an understatement here. A client's project (with not necessarily technical customers) has had pretty reasonable success using the Dropbox originated library[1] for this, `zxcvbn`[2], on both frontend via js (for "instant" feedback) and on the backend via php (to enforce the requirements when writing password hashes to the database) 1: https://dropbox.tech/security/zxcvbn-realistic-password-strength-estimation https://dropbox.tech/security/zxcvbn-realistic-password-stre... 2: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn