[whiskeySix]

any clientside validation can easily be bypassed using something like fiddler.

[FabHK]

Password strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.