I'm wondering at what point we'll see more sites transition to server generated passwords. At login time, the UX of a server generated password is about the sam

I'm wondering at what point we'll see more sites transition to server generated passwords. At login time, the UX of a server generated password is about the same for anyone who saves their password in a password manager, i.e. it autocompletes. But at password generation time, it's much easier. You don't need to tell the user all these rules about length, complexity, reuse, etc. The server generates the password in a way that's sufficient, and the user just saves it. It also avoids the mess of password manager generated passwords not meeting some criteria, or passwords meeting client side checks but failing server side checks. When you've got so many sites asking for passwords >=10, >=16 characters in length, is anyone actually able to memorize a truely unique password per-site any more? Besides, a server generated password has known entropy, so you can model the security much more accurately. This push for really long passwords is to guard against low entropy passwords that users create, although users seem to respond predictably: [password] too short? I'll try [password]123 or [password][password].