This. Imposing no restrictions is generally the best option for most websites, which should focus on things like rate limiting, secure hashing, and 2FA before g

This. Imposing no restrictions is generally the best option for most websites, which should focus on things like rate limiting, secure hashing, and 2FA before getting user-hostile wrt passwords.