SquareX-style weak-password policy. The password is scored ON-DEVICE; only the score is sent (never the password). Weak passwords trigger an in-page warning.
PASS 0 · FAIL 0 / 0
Each tile opens a SaaS app and auto-signs-in with the listed password. A weak password (< 40/100)
fires a password-strength warning (LOW — in-page card + dashboard, no block). Passwords scoring
≥ 40 stay silent. Threshold/score: length + character types − common-password / predictable-pattern penalties.
Mirror: node bdr/tests/pwstrength-range-verify.mjs.