Reliably generating good passwords

The other side of the coin is detecting weak passwords when the user tries to use them. The standard way to do that is cracklib (and libpam-cracklib). Unfortunately, cracklib is a pile of heuristics and so it will only detect a small subset of weak passwords. The zxcvbn library is the best thing I've found to try to estimate password entropy. It uses a built-in word list, plus detecting common keyboard patterns in passwords (qwertyu, zxcvbn), and the same techniques password crackers use to mutate words. A libpam-zxcvbn would be nice to have.