Depends if you want anyone to use it; complex pwds are one of the biggest barriers to user registration. If your users are comfortable online they should be awa

Depends if you want anyone to use it; complex pwds are one of the biggest barriers to user registration. If your users are comfortable online they should be aware of the risks, and allowed to set simple pwds (a pwd strength indicator is useful). If not, and you're concerned about security, look into things like visual pwds (picking a picture from a much larger 'alphabet' of images), and / or two-factor authentication. What kind of app is it (game, banking, ...)?