Hey gooba! Thanks for wanting to try it out. And sorry, you ran into this issue.

It appears Laravels throttling function doesn't work well with my reverse proxy setup. I have disabled it for now. I have just tried it out and registering works again.

Again, sorry for this. This is my first publication attempt and I fear some issue will only show this way.. however, I'm here and happy to fix everything on the fly :)

Oh, and I missed the middle part of your post. Fair question! I do think it is quite sustainable. For that to make sense you might have to know me better, but my perspective is I have a good paying job, I have money and especially time to spare and I want to make things better. So I'm honestly happy to spend money AND time on this to be sustainable. I have a very capable root server to run this on and I have money already reserved to get another one. I'm getting by just fine and I'm more than happy to spend some hundreds of euros a month to make the world a little easier/better for people. I'm also happy to spend my time for this.

I did think a lot about monetizing it, but really I feel like that would skew the whole idea of the app. I want this to be for the community. We struggle enough with enshittification anywhere. I'm in a privileged position where I can build and maintain this. And it's available for self-hosting, so anybody can do so as well.

Now, if we were to hit an insane amount of users, the question might have to be tackled again, but that's far away and I think with the infrastructure I have and can get with my allocated "solidary" budget, It'd really have to get to insane amounts to actually be an issue.

So I'd like to think it is indeed sustainable. I'm doing this to be sustainable. I want to build something people appreciate and use. I'm happy to spend lots on it!

There really are only two dials you can turn to increase the security of a password, and that's length of the character set (the characters that the user can use in their password) and length of the password itself.

People should be using a password manager, then they can set that to 100/200 characters. Even if all lower case, it will be unbreakable (assuming a modern/secure one way hashing algorithm, and the password manager is truly random.).

If they are not using a password manager and use something like `waterfall!X` (because you enforce a special character and capital letter) you haven't actually increased entropy by that much, compared to a longer password. Them making up a 100 character password will almost guarantee more entropy than a short password they make up like `waterfall!X`

Also, because it's the internet [1]:

1. https://xkcd.com/936/

This opinion is worth what you paid for it:

Don't make your password requirements less strict. Don't encourage people to use weak passwords that are likely shared across sites. That leads to pain and suffering over the long term.

If you want to reduce friction for people who don't/won't use a password manager, provide a passwordless option like a login link that is e-mailed to them. Yes, people will likely complain about "your service is supposed to be my email, why are you requiring an e-mail to login", in which case they should be using a strong password.

To the person requesting weak passwords: Just set up google or firefox password password manager, it will auto suggest a strong password on the registration page and save it for use across devices. There is zero reason to be using the same password across accounts, and a lot of reason not to.

Attackers do actively try passwords you have used on other sites to try to compromise your accounts elsewhere. This happens when services leak passwords or password hashes. If your password is short and lowercase, it really doesn't matter if only your password hash has been leaked, it might as well have just been the password itself. This is the lowest-hanging fruit for attackers.