I could see it in my mind: a kind of frequency spectrum bar-chart of password components pulsing up and down like the graphic VU meter on a DJ's mixing panel. The height of the vertical bars represents the number of lowercase, uppercase, numbers and special characters present in the password as it is typed by an unsuspecting User--a password histogram. If the bars are more or less the same height the password is stronger than if the heights of the bars vary. The more irregular the heights are, the weaker is the password.

Also, as the password length increases, the overall height of the bars increases. Thus, the taller the meter, the stronger, yet, is the password. In my gut I knew there was a way to express this mathematically and after fiddling around with it, I drew the bars on a piece of paper, and that's when I saw it: each bar is an area (height = count, width = 1), and each area is a face on a crazy 4-dimensional solid. Multiply the areas together and you get a volume. The larger the volume, the stronger the password. All that is left is to determine the thresholds for the various degrees of strength.

It's easier to see in 3 dimensions. Picture a hexahedron with rectangular faces. It has a height, a width and a depth. Assign the uppercase count to the height, the numbers count to the width, and the special chars count to the depth. If all the counts are equal, then the shape is a cube. If, the counts vary, then the shape is composed of rectangles. Say the password is 9 characters long, and it has 3 uppercase, 3 numbers and 3 special chars. The volume is 3*3*3 or 27. Now, suppose the counts are: 7 uppercase, 1 number and 1 special char. The volume becomes a long thin sort of square rod kind of solid with a volume of 7*1*1 or 7 (much less than 27). How about something in the middle: 5 uppercase, 2 numbers and 2 special chars. That's 5*2*2 or 20, which is still less than 27. A cube is always going to have the greatest volume.

This also includes a "runs" detector. It's basically a digital hi-pass filter (or edge detector) with rectification (absolute zero applied to each difference). See comment on the detectRuns() method for details (this, almost certainly doesn't work with Unicode.). This, actually, could be used to generate an overall password strength, if the various char ranges were weighted to produce filterable edge intensities.

Here's the listing:

/**
 * Determines the strength of a given password based on
 * frequency of of occurrence of lowercase, uppercase,
 * numbers and the special characters passed via the spc_chars
 * argument.  The more even the spread of occurrences, the
 * stronger the password.
 *
 * This class contains the following public parameters:
 *   'lcase_count'    : lowercase occurrence count.
 *   'ucase_count'    : uppercase occurrence count.
 *   'num_count'      : number occurrence count.
 *   'schar_count'    : special character occurrence count.
 *   'length'         : length of password string.
 *   'strength'       : strength value of password.
 *   'verdict'        : textual strength indication
 *                      ['weak', 'medium', 'strong'].
 *
 * @param string arg_password  The password
 * @param string arg_spc_chars A string of special characters
 *     to search for in the password. By making this an
 *     argument, the range of special characters can be
 *     controlled  externally.
 * @return string The verdict as 'Weak'|'Medium'|'Strong'
 */
function Password(arg_password, arg_spc_chars)
{
    var password = arg_password;
    var spc_chars = arg_spc_chars;
    this.lcase_count = 0;
    this.ucase_count = 0;
    this.num_count = 0;
    this.schar_count = 0;
    this.length = 0;
    this.strength = 0;
    this.runs_score = 0;
    this.verdict = '';

    // These numbers are just guesses on my part (and not
    // all that educated, either ;) Adjust accordingly.
    var verdict_conv = {'weak':2.7, 'medium':53, 'strong':150};

    // These are weighting factors.  I figure that adding
    // numbers is a little better than adding uppercase
    // because numbers probably are not vulnerable to
    // dictionary searches, and adding special chars is
    // even better.  These factors provide yet another
    // dimension.  Again, there are only guesses.
    var flc = 1.0;  // lowercase factor
    var fuc = 1.0;  // uppercase factor
    var fnm = 1.3;  // number factor
    var fsc = 1.5;  // special char factor

    this.getStrength = function()
    {
        if ((this.run_score = this.detectRuns()) <= 1)
        {
            return "Very weak";
        }

        var regex_sc = new RegExp('['+spc_chars+']', 'g');

        this.lcase_count = password.match(/[a-z]/g);
        this.lcase_count = (this.lcase_count) ? this.lcase_count.length : 0;
        this.ucase_count = password.match(/[A-Z]/g);
        this.ucase_count = (this.ucase_count) ? this.ucase_count.length : 0;
        this.num_count   = password.match(/[0-9]/g);
        this.num_count   = (this.num_count) ? this.num_count.length : 0;
        this.schar_count = password.match(regex_sc);
        this.schar_count = (this.schar_count) ? this.schar_count.length : 0;
        this.length = password.length;

        var avg = this.length / 4;

        // I'm dividing by (avg + 1) to linearize the strength a bit.
        // To get a result that ranges from 0 to 1, divide 
        // by Math.pow(avg + 1, 4)
        this.strength = ((this.lcase_count * flc + 1) * 
                         (this.ucase_count * fuc + 1) *
                         (this.num_count * fnm + 1) * 
                         (this.schar_count * fsc + 1)) / (avg + 1);

        if (this.strength > verdict_conv.strong)
            this.verdict = 'Strong';
        else if (this.strength > verdict_conv.medium)
            this.verdict = 'Medium';
        else if (this.strength > verdict_conv.weak)
            this.verdict = 'Weak';
        else
            this.verdict = "Forget it!";

        return this.verdict;
    }

    // This is basically an edge detecter with a 'rectified' (or
    // absolute zero) result.  The difference of adjacent equivalent 
    // char values is zero.  The greater the difference, the higher
    // the result.  'aaaaa' sums to 0. 'abcde' sums to 1.  'acegi'
    // sums to 2, etc.  'aaazz', which has a sharp edge, sums to  
    // 6.25.  Any thing 1 or below is a run, and should be considered
    // weak.
    this.detectRuns = function()
    {
        var parts = password.split('');
        var ords = new Array();
        for (i in parts)
        {
            ords[i] = parts[i].charCodeAt(0);
        }

        var accum = 0;
        var lasti = ords.length-1

        for (var i=0; i < lasti; ++i)
        {
            accum += Math.abs(ords[i] - ords[i+1]);
        }

        return accum/lasti;
    }


    this.toString = function()
    {
        return 'lcase: '+this.lcase_count+
               ' -- ucase: '+this.ucase_count+
               ' -- nums: '+this.num_count+
               ' -- schar: '+this.schar_count+
               ' -- strength: '+this.strength+
               ' -- verdict: '+this.verdict;
    }
}

Usage:

function checkPassword()
{
    var special_chars = "~!@#$%&*";

    var pw = new Password(document.getElementById('da_password').value, 
                           special_chars);

    var verdict = pw.getStrength();
    var hint = '';
    if (pw.ucase_count == 0) hint += "Try adding some uppercase letters. ";
    if (pw.num_count == 0) hint += "Try adding some numbers. ";
    if (pw.schar_count == 0) hint += 
        "Try adding one or more of the following characters: "+
        special_chars+".";
    if (pw.run_score <= 1) hint += "Avoid runs (e.g. 'aaaa', 'efghi', '1234'). ";
    element = document.getElementById("hint");
    element.innerHTML = hint;
    element = document.getElementById("strength");
    element.innerHTML = verdict;
}

The HTML:

 
    <input type="text" id="da_password" onkeyup="checkPassword()"/>
    <div id="hint"></div>
    <div id="strength"></div>

Missing is a dictionary look-up. Also, certain special chars will break this (such as '^').