In the admin panel an administrator can implement a password policy for users. Elgg has a default policy of 6 characters and implements a way to avoid brute force attacks. 

This plugin makes it possible to force users to a strong password policy. The administrator can select any combination of number of characters, upper and lower case combinations, numbers and special characters to be used.

During registration or password change, the policy is shown to the user and a bar shows if it is strong enough,