Good idea, but password complexity is not measured with characters list or types but with entropy.
You can have good password with 7 characters and bad password with 10 characters.
An example to understand. I used KeePassXC password generator to measure these passwords entropy:
This is 7 characters password:
⊌ӊ⇊ٳ➟⋋О
Entropy: 116 bits.
Only "special characters". No length, No Alphanumeric, no mixed case.
This is 15 characters password:
8&w^3fck%NdMh4W
Entropy: 94 bits
Length, Alphanumeric, Special characters, Mixed case.
The first one only respect one requirement asked but is better than the second that respect all. The difference is huge if try with only 12 characters:
gx@V5iZLfuN7
Entropy: 65 bits. All requirements mets as the previous one, and it's not the worst i can have with 12 characters.
As it's common mistakes about password complexity, i think Cloudron should never allow to require characters list/types.
Instead, password complexity requirements should be technically measured with true entropy/bits algorithm as in KeePassXC that way good password will be allowed based on real complexity not on arbitrary rules.
The settings can always be displayed simple in settings with "Weak", "Average", "Good", "Excellent", etc... instead of entropy bits.
Finally, asking password to have specific characters list or type will break auto-generated password by password manager because websites has not all the same rules and password generators not the same default settings.
I hope this will help.
