"What should service providers do?": https://tomssl.com/2016/10/21/a-sensible-password-strategy/

This is a pretty straightforward set of expectations which should solve most issues.