Password complexity tends to more harm than good. Users aren't that creative and nearly every password falls into the pattern (A-Z)\w\d!. If we assume that use

Password complexity tends to more harm than good. Users aren't that creative and nearly every password falls into the pattern (A-Z)\w\d!. If we assume that users pad out to the bare minimum length then mandatory complexity actually reduces entropy because we know more specifically what characters are at the beginning and end.