Is it a good idea to expire passwords after a time relative to their complexity? Is it a good way to teach users to use secure passwords? (relevant xkcd: correct horse battery staple)
I'm thinking of giving hints on how to make the password stronger, and displaying the expiration date of the new password while the user is typing it.
There seems to be a lot of answers pointing out that storing the relative difficulty of passwords (or something that hints of it) is insecure. That is true for most systems used today, but it doesn't have to be. If the passwords expire in 1/1000 the time it would take all computers on earth to crack it, it would still be fairly secure. The point of a variable expiration would be to allow less secure passwords, rather than forcing everyone to use one that will be secure until the heat death of the universe. Switching passwords every few years, while being allowed to use a 10-20 character shorter password, is probably a good tradeoff for many people.
It turns out that this security concern isn't even the real issue, as the great people over at Security SE pointed out. From a security perspective, expiring passwords are used to limit the time a compromised password (e.g. from shoulder surfing) can be used. As they point out, if you have access to the hashes, and thus the ability to attack them locally to avoid any rate limiting set up on the site, you probably have enough access to the system to do whatever you want anyway.