we do have work on password management w3c.github.io/webappsec-cred… - in terms of password syntax, NIST has recommendations pages.nist.gov/800-63-3/sp80… ; and of course, #webauthn paves the way to #passwordless to make this a problem of the past :)