--- a/MoinMoin/config/default.py	Tue Apr 02 00:39:37 2013 +0200
+++ b/MoinMoin/config/default.py	Sun Apr 07 19:11:37 2013 +0200
@@ -261,7 +261,8 @@
     # the options dictionary.
 
 
-def _default_password_checker(cfg, username, password):
+def _default_password_checker(cfg, username, password,
+                              min_length=8, min_different=5):
     """ Check if a password is secure enough.
         We use a built-in check to get rid of the worst passwords.
 
@@ -274,10 +275,12 @@
                  some unicode object with an error msg, if the password is problematic.
     """
     # in any case, do a very simple built-in check to avoid the worst passwords
-    if len(password) < 6:
-        return _("Password is too short.")
-    if len(set(password)) < 4:
-        return _("Password has not enough different characters.")
+    if len(password) < min_length:
+        return _("For a password a minimum length of %(min_length)d characters is required.",
+                 min_length=min_length)
+    if len(set(password)) < min_different:
+        return _("For a password a minimum of %(min_different)d different characters is required.",
+                 min_different=min_different)
 
     username_lower = username.lower()
     password_lower = password.lower()
@@ -329,7 +332,7 @@
          [],
          "Exclude unwanted endpoints (list of strings)"),
         ('password_checker', DefaultExpression('_default_password_checker'),
-         'checks whether a password is acceptable (default check is length >= 6, at least 4 different chars, no keyboard sequence, not username used somehow (you can switch this off by using `None`)'),
+         'does simple checks whether a password is acceptable (you can switch this off by using `None` or enhance it by using a custom checker)'),
 
         ('passlib_crypt_context', dict(
             # schemes we want to support (or deprecated schemes for which we still have

--- a/docs/admin/configure.rst	Tue Apr 02 00:39:37 2013 +0200
+++ b/docs/admin/configure.rst	Sun Apr 07 19:11:37 2013 +0200
@@ -621,12 +621,34 @@
 password checker that is enabled by default and does some sanity checks, 
 so users don't choose easily crackable passwords.
 
-If your site has rather low security requirements, you can disable the checker by::
+It **does** check:
+
+* length of password (default minimum: 8)
+* amount of different characters in password (default minimum: 5)
+* password does not contain user name
+* user name does not contain password
+* password is not a keyboard sequence (like "ASDFghjkl" or "987654321"),
+  currently we have only US and DE keyboard data built-in.
+
+It **does not** check:
+
+* whether the password is in a well-known dictionary or password list
+* whether a password cracker can break it
 
-    password_checker = None # no password checking
+If you are not satisfied with the default values, you can easily customize the
+checker::
+
+    from MoinMoin.config.default import DefaultConfig, _default_password_checker
+    password_checker = lambda cfg, name, pw: _default_password_checker(
+                           cfg, name, pw, min_length=10, min_different=6)
 
-Note that the builtin password checker only does a few very fundamental
-checks, it e.g. won't forbid using a dictionary word as password.
+You could also completely replace it with your own implementation.
+
+If your site has rather low security requirements, you can disable the checker
+by::
+
+    password_checker = None  # no password checking
+
 
 Password storage
 ----------------