PasswordStats: smart_strength()