I think that the requirement on passwd are good.
May be we could just explain how to craft a password fullfilling the requirements which does not imply a headache.


My usual favorite being to use the initial letter for each word of a phrase (possibly long) an replace 'to' with '2'  or drop a '+' or '-' as separator and drop in some number of space for punctuation.

This usually fullfil most of "strong" passwd requirement and do not require a lot for remembering it.

Moroever if the passwd recovery process is efficient forgetting a passwd is not that bad. I'm speaking of passwd for the average project user not for sys admin of course.

Then my opinion is:

Keep strong requirement on passwd.
Give more advice about two 'create' strong passwd to the user.

The password I was choosing should be plenty strong for this.
As far as the admins go, why not make them have more stringent requirements but reasonable requirements for normal users?

I strongly dislike how paranoid many Unix users/advocates are about security. My memory is quite poor so remembering complex passwords is next to impossible especially for sites I would rarely log in to. My only other option is to use a password manager (which is insecure)

Password requirements are far too complicated to figure out
and pointless for something such as project hosting.

Rather then all the complication you should just put something obvious for normal people to figure out like an 8 character minimum