Currently, the only limitation for passwords is: they have to be 6 characters long.
We should enforce passwords strengh, by forcing the user to:
We could add this package and make sure we enforce strong passwords : https://github.com/schuppo/PasswordStrengthPackage
Ideally, you would explain why we need this in the body of your issue, so we can discuss the feature itself.
Have a look at https://github.com/dropbox/zxcvbn. The library avoids some of the mistakes of common "strength meters", which often classify "Password&1" as strong (Lowercase, uppercase, more than 8 chars, special char, number).
The static hash list from haveibeenpwned is another good idea.
Most helpful comment
Have a look at https://github.com/dropbox/zxcvbn. The library avoids some of the mistakes of common "strength meters", which often classify "Password&1" as strong (Lowercase, uppercase, more than 8 chars, special char, number).
The static hash list from haveibeenpwned is another good idea.