yep this is the way forward, ideally with something like the proposed passwordrules attribute

https://github.com/whatwg/html/issues/3518