Think of those fields as secondary password fields and act accordingly.

Diceware can also be useful for when they need to be spoken on the phone. With the right amount of words (7 or more) it has reasonably good entropy too.