diff --git a/js/app.sync.js b/js/app.sync.js
index 869d603..19c59fb 100644
--- a/js/app.sync.js
+++ b/js/app.sync.js
@@ -124,13 +124,16 @@ async function syncSetEncPwdFlow() {
             title:    'Set sync password',
             message:  'Use the SAME password on every device that syncs with this remote. ' +
                       'Stored DPAPI-protected on this device only — never transmitted.',
-            placeholder: 'At least 8 characters',
+            placeholder: '12+ chars, mix letters/digits/symbols',
             password: true,
             okText:   'Save',
             error:    err,
         });
         if (!v) return;
-        if (v.length >= 8) {
+        // This password is the ONLY thing protecting the remote snapshot
+        // (§1.4) — enforce a real minimum. computeStrength reused from app.js
+        // (no zxcvbn dep). >=12 + one complexity category clears 50.
+        if (v.length >= 12 && computeStrength(v) >= 50) {
             Bridge.setPref(SYNC_PREFS.encPwd, v);
             const pwdStatus = document.getElementById('syncPwdStatus');
             if (pwdStatus) pwdStatus.textContent = 'Set.';
@@ -139,7 +142,7 @@ async function syncSetEncPwdFlow() {
         }
         n++;
         if (n >= 5) return toast('Too many invalid attempts', 'error');
-        err = 'Use at least 8 characters (attempt ' + n + ' / 5).';
+        err = 'Too weak — use 12+ chars mixing letters, digits and symbols (attempt ' + n + ' / 5).';
     }
 }