I see how this wasn’t obvious, but I never actually said anyone should implement any particular password requirements, just that certain requirements might not

I see how this wasn’t obvious, but I never actually said anyone should implement any particular password requirements, just that certain requirements might not increase entropy as much as you might think. My above comment about offline attacks was my personal stance/ideal: I use a password manager for just about everything, not something I’d mandate. As a developer, in many contexts I might implement min 8 chars with no special char requirements. I think the bad password check is also a good idea.