If these sorts of 'strength checkers' become ubiquitous across enough places, I wonder how much value there will be in using reverse-engineered (most of these are in JS for UX latency reasons, right?) models of their strength testing as another parameter to your brute-forcing module.<p>Then you can automatically skip any password you know is <i>too</i> simple, because the site won't have allowed the user to set it in the first place. You could also de-weight any constructions your generator is using (keyboard locality, l33t, ..), rather than positively weighting them as is done now.<p>Intuitively, it seems like the more restrictions placed on a password (must have 1 <i>x</i> char, no more than 20 total chars, ...), the smaller the entire search space. But where is the inflexion point where these rules generate stronger passwords than they assist.<p>Then again, if you're doing your hashing and storage right, brute force ain't gonna help.