I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best option for making users create strong, but still easy to remember passwords.
You cannot test for password strength, on looking at the password alone. Password strength is a property of how the password is generated, which you cannot measure or even estimate more or less approximately by just looking at the password ("password meters" are a joke -- one of the best jokes: the kind which many people believe).
If you enforce strict rules on passwords, users will rebel and indulge in practices which degrade security (e.g. writing down the password on a stick-up note concealed under the keyboard, or reuse of passwords between sites).
You can help users by giving them a password generator which follows high entropy rules (this time you know how passwords are generated, so you can measure the entropy). The "correct horse" method would be a good idea.
Many of the rules you see in practice are quite useless. Requiring at least one capital letter and a number annoy users who are not allowed to pick
password, but it fails to induce them to pick a good one. In general, they just pick
Password1 instead. That password would pass many filters, but still it has been leaked over 100 000 times.
You can try to make your rules more complex. Let's say the number can't be at the end! Well, your lazy users will put it at the front instead. That password has been leaked over 2 000 times. You can continue this game of cat and mouse with your users, but it's a loosing game. You will annoy your users more and more, and unless they drop out in frustration they will still pick shitty passwords. People are lazy, and you can not change that with complicated rules or entropy calculations.
So, what to do instead?
- Length limits: You should have a minimum length. This should be at least 8, but 10 or 12 is probably better. If your hashing algorithm has a max length (e.g. bcrypt cuts everything at 72 characters), you should enforce that max length as well so that users don't belive their password is longer than it actually is. But don't enforce a short max length like 32 for no reason.
- Blacklist common passwords: This is important. Very important. You need to check the password against a long list of leaked passwords. If the password has been leaked more than N times (personally, I'd argue for N = 1), block it. To date, the best such list is Pwned Passwords.
- Blacklist obvious picks: A tempting choice of password is to just reuse the username or some other personal info provided, the site name or a variation thereof, or a term strongly related to the topic of the site. One way to do this is to check that the password still passes the minimum length requirement even after you remove any such words. You don't want to let users pick
LetItGoas password on your Frozen fan site.