Do you test this against password managers? Seems like this approach could generate false positives