This isn't even a programming question. It's a thinly veiled "what algo should I use to check password strength", which we all known the modern answer to password.lenght() > 12
. It doesn't offer anything novel and I'm sure guys at Sec.SE would tore this apart and make an actual good questions about it, like How can we accurately measure a password entropy range? and How reliable is a password strength checker?. No information on this question follows reasonable security practices and misinforms users that this is a acceptable practice.
PS. if you measure password strength by other than length, I implore you to stop those practices and remember xkcd 936.