In an excellent example of how password strength meters make you LESS secure, the Thycotic Secret Server calls a 73 character OAUTH access token "weak" because it only has lowercase letters and hex digits. And I'm supposed to trust this company to protect my secrets?