On Friday I had to change my password at my client site. The rules they have are ridiculous. They are all the standard ones about must have uppercase, punctuation, minimum length, etc as well as.
- The first character cannot be punctuation character.
- No dictionary words.
- The same character cannot be used twice.
The problem is that they are so complex it is almost impossible to find one, particularly as the error message does not tell you the additional requirements they have.
I called the help desk and they said, just use one like this Pa5word# (not the real password) and then keep incrementing the number ....
I find these systems completely crazy as they stop you from using passphrases for example "thisismypasswordforjanurary" is very easy to remember and very secure, but most systems wont allow those types of pass phrases.
So I would vote for a high minimum length, say 15-20 characters that way people can't just use words and l33t style passwords aren't required.
Whatever you choose, I would make sure you document what the restrictions are, and why they are there and some examples for users to help them generate secure ones.