Also, I'd encourage the use of "passphrase" rather than "password".
No-one normal can remember tr5vgh6##t5, but something like "$firstpetsname notatafarm garbagecan" is secure and easily remembered.
Having tried to use that, I can assure you that no one actually (a) remembers their passphrase, nor (b) is willing to type it in when it does come up. It's a fun idea, but it's actually much worse UX than even a secure password.
Having tried to use that, I can assure you that no one actually (a) remembers their passphrase, nor (b) is willing to type it in when it does come up. It's a fun idea, but it's actually much worse UX than even a secure password.