First I think it prudent to understand mathematical password entropy. The wiki on Password Strength is a good place to start, but in short, password entropy the likely hood a password can be guessed given a pool of symbols.
This is neither complexity or "crack-ability", entropy is mutually exclusive these two concepts are not.
Entropy is important to understand first because it has two requirements:
- Number of symbols
- The length of those symbols
Number of Symbols
The number of symbols provided is a baseline for the number of bits of entropy per symbol. The uppercase alphabet alone doesn't have same entropy bits as if you include the lowercase symbols as well. If you include numbers, the entropy per symbol increases. The more symbols you add, the more bits of entropy you gain per symbol, in other terms, the larger your pool of symbols, the larger the entropy is for each symbol.
Length of Symbols
The length of symbols is important because each added symbol effectively doubles yours entropy. This is why length alone is such an important concept pushed in password security.
What is complexity?
Complexity of a password is the rules we put in place to enforce the "randomness" of passwords. Here are the basic rules:
- Uppercase
- Lowercase
- Number
- Special Character
These are common to most people. Websites use it all the time to try and force people in to randomness. We, however, are not random. This is why attackers can use something like dictionary attacks, and predictive algorithms to guess passwords.
It goes beyond that though to include security measures such as:
- Encryption or Hash used
- The strength of a salt
- Security of a Private key
and so on.
Crack-ability
This is way more complicated than a simple post here. It is however an interesting topics (least to me :) ). Crack-ability is subjective, and the part that you need to understand is that you can only measure this concept based on a defined rules set. (I can't thing of a better word, I don't like "Crack-ability", but I'm pretty sure I understand what your asking).
PCFG Generator
Depending on what your trying to define using the PCFG it can be pretty complex. The basics of a PCFG is that if you feed it something, common words, phrases, etc, it provides a probability of what might be selected next. You can see this in every day life using smart phones with predictive text. (Did you ever notice that when you first started using it, the guesses were meh and now it pretty good at knowing what you are going to say?)
You could fed it common passwords, and than check probably of a person using that password.
For you project, unless you are trying to gauge the likely hood a person will select a password, I would suggest looking in to something else.
