Hmm.. This is a good question.
Passwords and password strength are a heavily debated topic. I think before we can determine a good UX, we should better understand what we're trying to accomplish: solid, secure passwords.
How we might encourage our users to create better passwords?
Most websites enforce password policies like:
- Minimum of 8 characters
- At least one capital letter
- At least one special character
Or they won't require them, and instead will show a strength indicator to abstract away the "qualities of a good password", hoping that the indicator will encourage good/strong passwords.
However, many argue that passwords generated with these requirements are hard for humans to remember (bad UX), and relatively easy for brute force attempts and other hacking methods to crack. The alternative being "4 word passwords" (easy to remember, hard to hack), and backing up authentication with something like 2-factor authentication
But I'm digressing. My answer:
- Determine what kind of passwords make the most sense for your users, and the application
- Decide how strictly to enforce your guidelines/rules
- Use placeholder text as an example quality password: "e.g. HorseWhistleIndianKiss"
- Consider other options for encouraging higher quality passwords
Food for thought: Do we event want our users to have password?
The argument used to be: Why force our users to have another set of credentials to remember for our website? Don't they already have enough? MailChimp has a really good blog post on this very topic. They found that more than 60,000 users a month forgot their passwords.