On: 86% of CrashCrate subscribers used passwords already leaked in other breaches

[yunruse]

Have you tried zxcvbn [1]? It’s a pretty good heuristic, with common names and character replacement built in, alongside the ability to provide a custom dictionary with heavy weighting (eg your user’s names, email, address).

[1] https://github.com/nulab/zxcvbn4j