nbvcxz

Also been using it for a while. No complaints here. Funny enough, it uses the zxcvbn Java clone [1] I wrote to estimate password strength and for new password generation. [1]: https://github.com/GoSimpleLLC/nbvcxz

The very first line of the README: nbvcxz is java library (and standalone console program) which is heavily inspired by the work in zxcvbn. Also it has https://github.com/GoSimpleLLC/nbvcxz#differentiating-featur... for its own features, but not necessarily how it compares to zxcvbn.

Another option if you're able to do a server side check, is to use a library like nbvcxz (Full disclosure, I wrote it): https://github.com/GoSimpleLLC/nbvcxz If you have a list of passwords you want to exclude, you can load it into the library, or it comes with it's own list of common passwords from leaked datasets.

I just released Nbvcxz 1.4.0 (https://github.com/GoSimpleLLC/nbvcxz/releases/tag/1.4.0) which with the help of the community, now supports 8 different languages. I crowd sourced translations through Reddit /r/translator, by asking for help with two specific translations (Spanish and French). I also asked for help on /r/java for any languages others may be able to help translate to, and others jumped in and offered translations to a bunch of different languages (Russian, Ukrainian, Portuguese, Afrikaans, and Hungarian).

I totally agree that arbitrary password rules are not a good thing, they frustrate users to no end, and can make things less secure. I really liked the zxcvbn library from Dropbox, as it allows you to catch those really egregiously bad passwords before it's too late, but is much smarter than any list of arbitrary rules could be. I actually wrote a similar library (nbvcxz - https://github.com/GoSimpleLLC/nbvcxz) for my company which implements all of the functionality of zxcvbn (and extends it as well) so I could use it on the server side.

If you want to use a server side tool, I wrote a port of it in Java (with quite a few extra features): https://github.com/GoSimpleLLC/nbvcxz At least on the server side, size doesn't matter quite as much.

Interestingly enough, I just recently released a password strength library which can help enforce these exact requirements. https://github.com/GoSimpleLLC/nbvcxz