"Just show a good password strength meter to the user and fine-tune it to your security requirements." That's the approach I follow in my projects. I offer a

"Just show a good password strength meter to the user and fine-tune it to your security requirements." That's the approach I follow in my projects. I offer a Javascript (window.crypto powered) Diceware passphrase generator and use zxcvbn to let users know the relative strength of the password they've supplied. I've also been planning an experiment to see if the width of a password field results in users choosing longer passwords, because more empty space. :)