Yeah, kind of a lesser of two evils sort of thing. Though immediate validation client-size would help. The best UX would be to just not have ridiculous rules li

Yeah, kind of a lesser of two evils sort of thing. Though immediate validation client-size would help. The best UX would be to just not have ridiculous rules like "cannot contain %" I was referring more to the "cannot be the same as last 4" policy and things like really long password lengths (too long to expect a reasonable person to type in). If your max length is, say 500, you probably don't need to include it in a long list because a reasonable person would never hit 500.