Review length, character variety, repetition, sequences, common patterns, and approximate search space without transmitting the password.