I suppose I was thinking, if HIBP is not good enough on its own, what good is it at all? But I see that it is indisposable.

@BruceWayne I think your comment there is what has helped me understand. I have been comparing this HIBP method to zxcvbn, and thought that since zxcvbn contains a list of commonly-used words in password, it would solve this problem. But I see now that this is not enough. It would seem both of these validations are necessary.

@SteveSether I think the zxcvbn password strength meter does a pretty good job. Also the best thing HIBP seems to give the world is knowledge when your account has been compromised, not really anything to do with how good your password is.

Why do you say "and therefore worthless"? That greatly depends on the contents of the document, does it not? If the document is a purchased pdf of a comic book, it is still valuable for fun to read, even if you can no longer prove that you were the purchaser.

@LukeSawczak Exactly! That's what Score_Under is saying... Please just use the phrase "dictionary attack" to be even more clear. It's really easy to mistakenly think the calculations are based on character-by-character brute forcing.

@forest Good point! I perhaps should have posted this as a question first.

Furthermore, would you rather have a webpage that takes 30 seconds to load, or your data leaked all over the Internet? One of these problems is fixable; the other is not.

@MatthieuM. How are ORMs not a silver bullet for SQL injection, which is what this question is about?