I hate password rules
NIST best practice recommendations state:<p>* Require more than 8 characters<p>* Don't require special characters<p>* Don't force the user to reset their password<p>* Do check for compromised passwords<p>* Require MFA<p>* ...<p>All very sensible.<p><a href="https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/" rel="nofollow">https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...</a>