Eh, I feel like this is pretty bland. It should incorporate a dictionary attack database. For example, "password" should be considered way weaker than any combination of letters. I would look at https://howsecureismypassword.net/ for inspiration.