I'd rather err on the side of disallowing more things than, for example, allowing a change from "hello" to "shello" (which only has one character the same according to Abigail's test) or from "super" to "repus" (a simple reversing that even Text::Levenshtein would say requires quite a few substitutions):

    my $count = () = $new =~ /[^\Q$old\E]/g;
[download]

This sets $count to the number of characters in the new password that were nowhere in the old password.

                - tye