I completely agree with the article. From what we can tell password strength meters mostly work, or at least work &quot;well enough.&quot; Some users attempt to game the system and in doing so wind up with marginally more secure passwords.<p>We also found 2F easier to implement than even we expected. Google Authenticator uses something called &quot;Time-based One-time Password Algorithm&quot; or TOTP for short. Even ignoring all the open source code and libraries, it actually isn&#x27;t really at all complicated to do yourself. The hardest part is generating the QR codes for Google Authenticator (which, yes, we did utilise a library for). Even the storage requirements are low.<p>Our current passwords rules are:<p>- Minimum 6 characters<p>- Maximum 256 characters (for DDoS protection reasons, long passwords cause a high CPU load on our micro-instances)<p>- We technically allow a &quot;weak&quot; password but bring up a pop-up (strongly discourage it).<p>- We do have password expiration (90 days) and history (3x) due to unavoidable organisational requirements<p>But overall we&#x27;re pretty liberal. You can use sentence based passwords and typically they&#x27;re marked as &quot;secure&quot; in the traffic light score system.<p>&gt; Forget about the now famous XKCD strip that proves a long lowercase password is more secure than a short dollar-sign-riddled password.<p>Technically what it proves is that you can replace one character in a complex password with one word in a sentence based password and get similar (or better) levels of security, even if the attacker knows you utilise sentence based passwords.<p>For example, a En-US keyboard has approx. 100 characters on it. A child&#x27;s dictionary has about 10,000 words in it. But in reality less than 1&#x2F;2 of those keys are ever typed, and less than 1&#x2F;16 of those words regularly used (plus you have predictable words like &quot;The&quot; &quot;A&quot; &quot;I&quot; &quot;And&quot; etc which have less security value).<p>So a good rule of thumb is: If you move from random character passwords to sentence based passwords, keep the letters in the former the same as the words in the latter (e.g. 6x characters = 6x words, 8x characters = 8x words, etc).<p>This gives you the best chance of remaining either as secure or MORE secure while moving to lower case sentence based passwords.