As well as killing conversion, this will pretty near force your users to write the password down. That's another attack vector (that you can't do anything at al

As well as killing conversion, this will pretty near force your users to write the password down. That's another attack vector (that you can't do anything at all about). The middle ground is a policy that enforces harder to bruteforce passwords (eg. at least one of each: upper case, lower case, numeral. Minimum length and no combinations of dictionary word + easily guessed number). Of course, the more complicated you make it, the more likely the user will write it down, forget it, not bother with your service, and/or curse your name.