You also need to only give the feedback on password quality after user has entered it twice; until then, "passwords do not match" is the only piece of info.