While the user types his new password, or after keyboard focus leaves the text field, show
an estimate of the password strength beside the text field. At minimum, display a text and/
or graphic label indicating a weak, medium, or strong password, and special wording to
describe a too-short or invalid password. Colors help: red for unacceptable, green or blue
for good, and some other color (often yellow) in between.
If you can, show additional text with specific advice on how to make a weak password
better—a minimum length of eight characters (for instance), or the inclusion of numbers
or capital letters. A user might get frustrated if he repeatedly fails to produce a valid password,
so help him be successful.
Also, the form containing the password field should use Input Hints or other text to explain
this beforehand. A short reminder of good password heuristics can be useful to users who
need reminders, and if your system will actually reject weak passwords, you should warn
the user about it before he finishes the form! Many systems require a minimum number
of characters for a valid password, such as six or eight.
(Remember, never actually show a password, and don’t make suggestions of alternative
passwords. General hints are all you can really give.)