PasswordStrength validation constraint scores are unclear

[4d4ch4u32]

As noted in this issue symfony/symfony#50651 it's unclear (for me) what the score level 1-4 means which is documented here https://symfony.com/doc/current/reference/constraints/PasswordStrength.html#minscore

Which conditions must be satisfied in each case for the password to be valid?

[javiereguiluz]

This constraint doesn't check a set of rules (use lowercase and uppercase; use numbers and letters, etc.).

It "just" checks the password length and the number of unique characters. Then uses that information to classify the password strength:

$entropy = log(\strlen(count_chars($password, 3)) ** \strlen($password), 2);

return match (true) {
    $entropy >= 120 => PasswordStrength::STRENGTH_VERY_STRONG,
    $entropy >= 100 => PasswordStrength::STRENGTH_STRONG,
    $entropy >= 80 => PasswordStrength::STRENGTH_REASONABLE,
    $entropy >= 60 => PasswordStrength::STRENGTH_WEAK,
    default => PasswordStrength::STRENGTH_VERY_WEAK,
};