[troupo]

> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password

This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Besides,

--- start quote ---

Using complexity requirements (that is, where staff can only use passwords that are suitably complex) is a poor defence against guessing attacks. It places an extra burden on users, many of whom will use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required 'complexity' criteria.

https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

--- end quote ---

[user_7832]

> This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Oh, I'm well aware (with the concept and comic both). My passwords that I set for myself almost always are like that. It's just that I wasn't sure if OP was aware of it, due to what their site was asking.

[RugnirViking]

This. The siren song of "oh but increasing the number of characters makes brute forcing harder exponentially" is defeated in practice by the fact that everybody's password is following a few predictable patterns. You know what else increases the complexity exponentially? Longer passwords

[bitexploder]

You know what else increases the odds you can’t brute force it? Not having one :)

Seriously though, the best password boxes are one that have an entropy meter and check that your password has never been in a breach.

[jorisw]

Seconded

https://blog.codinghorror.com/password-rules-are-bullshit/