The current defaults for password length is 4 characters - thats crazy and should be changed to 12 characters.

There should be text on screen that states the minimum length AND a recommendation to use a password manager

The password strength script is anything but a password strength check. It is just counting the complexity not the entropy and basically in its current state will give the green light to a 4 character password.

There is no password strength check when creating the first super user at installation - 1234 is good enough :(

There are similarly lightweight scripts that can replace this useless on that actually measure the entropy https://github.com/autonomoussoftware/fast-password-entropy

Currently although we set a maxlength in the password input we dont set a minlength - instead we use a custom data-min-length which is just for the javascript and doesn't aid password managers etcc

The changes are relatively easy to make and I am happy to volunteer to do it if its seen to be a good idea

Thoughts?
@wilsonge @SniperSister