Why not let the administrator decide?

Why not let the administrator decide?

If the admin wants their users to have strong passwords, it should point them to password generators

Well, yes and no.

• If the generator generates truly random passwords then: No. This only works, if the password does never have to be remembered. This does not work for many passwords that matter like main login passwords or password manager main passwords.

• If the generator generates these readable random passwords (like pwgen (1)) then: Maybe. They are still kind of hard to remember and therefore risk being short or written down on Post-Its.

• If the generator generates long xkcd-936 style passwords then: Yes. Is there a generator with a big enough word database that can do this?

The most important thing and at the same time the hardest thing is to get the old and counterproductive rules out of people's heads. There are rules like "8 chars are enough", "passwords must be as complicated as possible" or "no words from the dictionary" that truly hurt security, but are buried deep in peoples heads. I have no idea how to do that easily, though. Unlearning is harder than learning. :)

$ whatis xkcdpass
xkcdpass (1)         - generate memorable, secure multiword passphrases