Something like https://twofactorauth.org/ for password limitations would be great.