[dredmorbius]

You don't want to restrict on any password aspect but this:

Is the password known?

Any sort password is know. There are lists of millions of known passwords.

Better would be to get away from passwords entirely.

NB: I've been checking the xkcdpass utility (available on Debian). Generated 50 sets of 100,000,000 passwords each, comprised of six words (the default), then sorted these uniq, and counted the output lines.

Any duplicates would result in fewer than 100,000,000 lines.

All fifty trials had no dupes.

Took most of a week to run that, on an older box :)