I think a password strength meter would be useful on password input fields.
Of course, it should be Opt-Out, so a .env variable should exist that enables/disables the meter from displaying.

Actually metering password strength is difficult (black magic), but I think dropbox/zxcvbn might be a good library to use.

Look and feel: I imagine a slim colored line at the bottom of the password input that suggests if the password is good or not (red, orange, green). Maybe the line should grow from left to right with increasing password strength - that's something I need to see first before I know if it's stupid or not.