PasswordStats: strength()