The best advice about passwords is: don't deal with passwords at all. Authenticate people through Google or Facebook or whatever. Not only it's one less password for people to remember, but also Google has better infastructure for authentication than you will have:
- they detect suspicious logins
- they support 2FA
- and their account recovery process is more nuanced than “we'll send a link to your email, unless you don't have access to that email anymore, in which case you're screwed”)
However, if you can't, don't want to, or just disagree with this opinion for some reason or another, the next best advice about passwords is just “always use scrypt”. Unfortunately, without knowing why exactly scrypt exists it's easy to think “oh I'll be fine with not using scrypt for this small site” or “oh they use SHA256 in this codebase I inherited, well it's okay I guess”, and almost always such thoughts are wrong, so a more detailed explanation would probably do some good.