Variant of user-friendly approach is to integrate some kind of password weakness test.
Or, at least, add a link to some online checking service (I saw something like that), which will guide user to select good passphrase.
Or, at least, add a link to some online checking service (I saw something like that), which will guide user to select good passphrase.
It's dangerous to test your phrase online. People could record them and add to their dictionary. Currently the only valid way is to restrict the minimum length. Even the entropy is low, unless you are using a sentence from books, a pass phrase of 30 characters should be pretty safe for normal accounts.
