Well reasoned, but then again I think you're worrying about the wrong kind of attacks. Knowledgeable hackers tuning their bruteforcing software to manually fiddled-out rules would be plausibe for very high value sites, but for your average internet site I tend to agree with JavaFan, it's not gonna happen. The value of these strength-o-meters is just in discouraging people from choosing something that's likely to be among an amateur attackers first (couple thousand) tries. Of course one could just use Crypt::Cracklib and reject the ones that are easily derived from a dictionary word or too short. Technically rejecting anything under 6 characters or so also does nothing else but reduce the number of possibilities but that's just the possibilities that will usually be tried first anyway.