Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it. Here's a gif of it in action: http:

Here's how I do passwords - require a certain amount of entropy, and compare vs common passwords on the backend. That's it. Here's a gif of it in action: http://files.jjcm.org/password.gif http://files.jjcm.org/password.gif And an example webcomponent that implements this: https://github.com/jjcm/soci-frontend/blob/master/components/soci-password.js#L162 https://github.com/jjcm/soci-frontend/blob/master/components... The ENTROPY_REQUIREMENT variable means you need a password that has at least 2^n possible combinations, given the character set and the length used. There's no restrictions other than that. If you want to only use lowercase letters, that's fine, as long as the length is long enough. If you include special characters, the length requirement drops. I use a simple message to tell the user whether or not a password is acceptable, along with a radial progress bar to demonstrate success: "Not strong enough. Add complexity until the circle fills."