Got it, appreciate you clearing that up. Essentially two sides of the same coin. I use a Java port (nbvcxz) that I wrote for securing our SaaS product, and we

Got it, appreciate you clearing that up. Essentially two sides of the same coin. I use a Java port (nbvcxz) that I wrote for securing our SaaS product, and we build personalized "exclusion dictionaries" for each user with things like their company name, first name, last name, email, etc. If the user tries to have those as part of their password, it will not add to the entropy of their password. We are limited in how much we know about each user though. Helps with the most egregious poor passwords, and should protect our customers/users from tools like this at least a bit.