"Verifiers SHOULD offer guidance to the subscriber, such as a password-strength meter, to assist the user in choosing a strong memorized secret. This is particularly important following the rejection of a memorized secret on the above list as it discourages trivial modification of listed (and likely very weak) memorized secrets."

Better Passwords provides this guidance after the form is submitted, whereas the password meter that exists before form submission is the default one provided by Drupal. It would be nice to replace that with something based on zxcvbn as well, so that the results would be closer.

Comments

dnotes created an issue.

nubeli’s picture

nubeli commented

I assume this would involve replacing core library which includes user.js and user.theme.js and replace with equivalent versions in this module.

Then it may require an ajax call to a php callback to retrieve the strength feedback.

This would be a nice solution if this was built since I think it's necessary to avoid confusion. But in the meanwhile I needed an easy solution so I created https://www.drupal.org/project/adequate_passwords - not quite "better" but maybe "better than nothing".