Awkward UI text displayed to end-users for constraints

Here's a start.

Passwords must meet the following requirements:

• You must include both upper and lower case letters.
• You must have at least 2 letter(s).
• There are certain words that are not allowed.
• Make sure the password is at least 8 characters long.
• You must have fewer than 2 identical characters in a row.
• You must meet a strength level of 50.
• Include at least 1 digit(s).
• You may not use the 1 past passwords.
• You must include at least 1 symbol(s).
• You may not include your username.

1. You should focus on helping the user achieve a positive outcome, not just bombard them with a list of problems to solve
2. It's not just any old password on the street, it's the user's password
3. You don't need to start every list item with "Password must have" (which I instinctively read in a robot voice in my head)
4. Words like "compliance" and "requirements" are business words for developers and stake-holders found in technical documents, they're not very friendly for end-users who are often already feeling stressed when needing to deal with passwords and security.

Agreed, except I'm not sure "requirements" is too unfamiliar or threatening to lay people.

Your new password is not strong enough. Please follow these guidelines:

I think it is inaccurate to refer to requirements as mere guidelines. Guidelines are just suggestions. Also, in line with your point #1, I think it would be good to avoid negative language if possible ("not strong enough").

You must include both upper and lower case letters.
You must have at least 2 letter(s).
There are certain words that are not allowed.
Make sure the password is at least 8 characters long.
You must have fewer than 2 identical characters in a row.
You must meet a strength level of 50.
Include at least 1 digit(s).
You may not use the 1 past passwords.
You must include at least 1 symbol(s).
You may not include your username.

To me the "You may" and "You must" comes off as imperative or even a bit accusatory. So I think it would be better to avoid the "you" in the requirements list, which is unneeded anyway.

Here is proposed text, based on NancyDru's above, that attempts to address thedavidmeister's four points, and also minimizes negative language.

Password requirements met:
[ meter ]

Your password must:
- Include both upper and lower case letters
- Have at least 2 letter(s)
- Not include certain disallowed words (Or: "Avoid including...")
- Be at least 8 characters long
- Have fewer than 2 identical characters in a row
- Have a strength level of at least 50
- Include at least 1 digit(s)
- Be different than your past 1 password(s)
- Include at least 1 symbol(s)
- Not include your username (Or: "Avoid including...")

Instead of "Your password must:", perhaps "For security, please change your password so it:"

If "requirements" is really objectionable, perhaps instead of "Password requirements met", "Password criteria met". I suspect the author of this branch used "Password compliance" instead of "Password strength" because it doesn't really make sense to say something has "1 of 4" strength.

Thanks. I'll try to make those changes today. Also I'd like to see if I can use format_plural() rather than (s). That will require adding a second string to the plugin definition, something like:

$plugin = array(
  'admin form callback' => 'password_policy_int_count_admin_form',
  'constraint callback' => 'password_policy_int_count_constraint',
  'message' => t('Include at least one digit.'),
  'plural' => t('Include at least @int_count digits.'),
  'prime value' => 'int_count',
  'config' => array(
    'int_count' => NULL,
  ),
);

Does anyone have a problem with that?

"In order for your new password to be strong, please follow these rules:"

For security, please change your password so it:

• Include both upper and lower case letters.
• Include at least 2 letter(s).
• Not include certain disallowed words.
• Be at least 8 characters long.
• Have fewer than 2 identical characters in a row.
• Have a strength level of at least 50.
• Include at least 1 digit(s).
• Be different than your 1 past passwords.
• Include at least 1 symbol(s).
• Avoid including your username.

Let's try it again. I don't really speak Test but I tried.