> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account fo

> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences Yes! Please. Let users determine the value of their accounts for themselves. If I decide that say, my HN account isn't valuable and use a common password that is shared with many websites, I know the risk I'm taking and I'd rather take it than have to mark down a unique password for HN. On sites I write I advocate for no password rules at all (hit enter is good enough for me, yes we can hash an empty string), have usually compromised on a simple length check. Proper password storage is important, use the latest bcrypt/scrypt/argon2, don't cheap out there. You can cheap out on password rules. If you want to write a fancy entropy checker, run it client side and tell the user how secure their password is, let them choose whether they want that or not.