Given a registration service website with rather lax password requirements for the users (6-12 characters with no special requirements), how can I safely analyze what quality of passwords users pick without storing them in plain text?
For background: This question came up when discussing whether or not users of the service pick sufficiently "good" passwords, and if they do not, if there is enough reason to enforce this by setting tighter password requirements. Assuming some sort of rating system for the password, what interests the team is the ratio of poor passwords (only letters, no special signs, no upper-/lower case variation, repeating signs, partial match with own name or email, etc) compared to good passwords.
Supposedly, implementing a rating algorithm that stores the password quality rating at the time users set their passwords would be a good way, but is there any more considerations to take with this? What kind of assertions about password quality can I make and rate without actually storing the passwords? And do I just log password ratings without any other data, or how could I cross reference password quality with user demographics (age, gender, activity on the service) in a way that respects user privacy and data security?