It's a delicate balance between accessibility (to your site and product) and good security practices (forced periodic password resets, force the use of special

It's a delicate balance between accessibility (to your site and product) and good security practices (forced periodic password resets, force the use of special characters in passwords, etc). The approach I like best so far is screening for the 1,000 or so most common passwords during account registration. Lists of these passwords are available from the Twitter Most Common Password list[0] or other leaks. If the user picks a password form this list then I politely ask them to pick another password. Optional: Suggest passwords to users! Write a simple generator that mixes two inoffensive dictionary words, a few numbers and a symbol into a string that should be fairly easy to memorize (ex: 9Nitrogenchair$) to make the password-picking job easier for them. [0] - http://elementdesignllc.com/2009/12/twitters-most-common-passwords/ http://elementdesignllc.com/2009/12/twitters-most-common-pas...