Hacker News Reader

You can see exactly how it is calculating the strength (and it includes spatial patterns; enough length and you do get some entropy out of it) here: https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...

Same here. I typed in a word and kept typing without numbers until it registered from very weak to strong. But a simple brute force would make short work of such a "source" password.

'I like to eat boogers' is strong. Not against a dictionary attack, I don't think.

It may actually be pretty strong - you have 5 words out of, let's say 2000 "frequently used English words" (totally picked the 2K number out of the air, and "boogers" is probably not as common) - you have 31,840,279,800,048,000 possibilities (according to wolfram-alpha "2000 choose permutations of 5").

This wasn't about password strength calculation - this is really a question to the maintainers of https://github.com/lowe/zxcvbn.