I worked on a crypto-related project where we ended up just generating a strong password on the client during registration. Credential stuffing attacks are just

I worked on a crypto-related project where we ended up just generating a strong password on the client during registration. Credential stuffing attacks are just too effective. Nobody complained. I think it's a better solution than making the user come up with their own strong password with annoying special character rules when you can just generate one for them. The interesting challenge was making it work well with all password managers though which often have mind-numbingly dumb heuristics about what could possibly be a password field. It's worth a blog post.