Password strength meter

The meter replaces a checklist of composition rules with one moving judgement. Instead of “at least one number, one capital, one symbol”, it says how good the password is right now and what would make it better, which lets a long ordinary phrase score well without having to satisfy rules that were never really about strength.

Two parts have to work together. The bar carries the score, and a line of text carries the reason. A bar alone is unreadable: nobody knows what two segments out of four means, and colour alone fails anyone who cannot see it. Read them together and the meter says something useful, like “weak, add a few more words”. The score also has to be honest, which in practice means estimating guessability, including dictionary words, keyboard runs, and known breached passwords, rather than counting character classes.

The meter’s real job is to advise, not to block. A strength score used as a hard gate turns into the composition rules it was meant to replace, and pushes people toward the shortest string that clears the bar. Let the meter say weak, keep the submit button live above a low floor, and put the strictness where it belongs: in rate limiting, in breach checks, and in a length minimum.

Announce the change politely rather than on every keystroke, keep the reading in reserved space so the form does not jump as the verdict grows a word, and pair it with a reveal control so a person can check what they actually typed.