Should really just use JSON or something. Also the password rules are unnecessary complex it doesn't need to provide the full rules just a regex that should ma

Should really just use JSON or something. Also the password rules are unnecessary complex it doesn't need to provide the full rules just a regex that should match and the password manager can just fill that in with randomness something like "[a-zA-Z0-9]{64}" The rules should also be provided in the password input field and the form should provided the reset url so that can be discovered something like: <form password-reset="/api/password/reset"> <input password-restriction="[a-zA-Z0-9]{64}" /> </form> Then the password manager can autofill with a correct password on account creation. I'd also use a json/http interface for resetting the password, means no restrictions on length and is much more familiar to the target audience.