If you can, show additional text with specific advice on how to make a weak password
better—a minimum length of eight characters (for instance), or the inclusion of numbers
or capital letters. A user might get frustrated if he repeatedly fails to produce a valid password,
so help him be successful.
Also, the form containing the password field should use Input Hints or other text to explain
this beforehand. A short reminder of good password heuristics can be useful to users who
need reminders, and if your system will actually reject weak passwords, you should warn
the user about it before he finishes the form! Many systems require a minimum number
of characters for a valid password, such as six or eight.
(Remember, never actually show a password, and don’t make suggestions of alternative
passwords. General hints are all you can really give.)
An explanation of password security is beyond the scope of a UI pattern. There are excellent
online and print references for this topic, however, should you need to understand it
more deeply