It’s good to recommend that passwords be 12 characters or longer, and the password-strength meter seems good enough. I tested it with CorrectHorseBatteryStaple (from xkcd 936) and it said the password is strong. But what I didn’t like in the suggestions in the demo strength meter site is that it keeps suggesting that the user avoid dictionary words and add one more symbols or one more digits.
> Your password is pretty good. Use it only for this account. (Why?)
> To make it even better:
> Don't use dictionary words (Correct, Battery, Staple and Horse) (Why?)
> Consider using 1 or more symbols (Why?)
> Consider using 1 or more digits
This essentially goes against the advice that passwords should be complex but also easier to remember (yes, many people still don’t use password managers) and also the advice not to force users to add symbols or digits.
I tried a few other different passwords and pass phrases with digits and symbols, but I saw a subtle coercion in the suggestions that would make a lay user doubt the password-strength meter and create extremely long and complex passwords (no pass phrases, since dictionary words and even terms in Wikipedia are flagged). It encourages you to add more digits and symbols even when you’ve already used a few.
In short, the password-strength meter seems fine, but the suggestions are not great.
> Your password is pretty good. Use it only for this account. (Why?)
> To make it even better:
> Don't use dictionary words (Correct, Battery, Staple and Horse) (Why?)
> Consider using 1 or more symbols (Why?)
> Consider using 1 or more digits
This essentially goes against the advice that passwords should be complex but also easier to remember (yes, many people still don’t use password managers) and also the advice not to force users to add symbols or digits.
I tried a few other different passwords and pass phrases with digits and symbols, but I saw a subtle coercion in the suggestions that would make a lay user doubt the password-strength meter and create extremely long and complex passwords (no pass phrases, since dictionary words and even terms in Wikipedia are flagged). It encourages you to add more digits and symbols even when you’ve already used a few.
In short, the password-strength meter seems fine, but the suggestions are not great.