Secrets

Make a secret, check one a client sent, and turn away one that is plainly weak.

API tokens, invite codes and temporary passwords from the characters you choose.

Check a key or token from a request in constant time, with no guard around the call.

Reject repetitive and sequential passwords. A pass is never proof of strength.