realistic password strength estimation