With an alphabet size of A, the number of passwords with N characters is equal to A-1 times the number of passwords with fewer than N characters, plus 1. This

With an alphabet size of A, the number of passwords with N characters is equal to A-1 times the number of passwords with fewer than N characters, plus 1. This means that if you allow at least uppercase and lowercase letters in the password, setting a minimum decreases the search space by less than 2%, assuming the minimum equals the maximum. If we even increase the maximum a tiny bit above the minimum, this decreases exponentially. Allowing a length of 8-20 instead of 18-20 only increases the search space by 0.0007%. So you have to ask yourself whether that tiny fraction of a percent more security for you against brute force attackers (which a proper password of that length is already secure enough against) is really worth having your money in a bank with easy to hack accounts. As a customer, part of the cost of all those hacked accounts is going to find its way to you eventually.