I'd argue the worst thing in Microsoft's password policy engine was "complexity" rules instead of any way for allowing entropy rules. A combo of "is this high

I'd argue the worst thing in Microsoft's password policy engine was "complexity" rules instead of any way for allowing entropy rules. A combo of "is this high enough entropy" and "is this in a rainbow table already" would let people have personal and memorable pass phrases. - Microsoft's own experience[1] realized length beats the "one of each kind of symbol" nonsense some time ago: https://docs.microsoft.com/en-us/archive/blogs/msftcam/password-complexity-versus-password-entropy https://docs.microsoft.com/en-us/archive/blogs/msftcam/passw... - Simple entropy checker: https://www.bee-man.us/computer/password_strength.html https://www.bee-man.us/computer/password_strength.html - Keepass tries a few other angles as well: https://keepass.info/help/kb/pw_quality_est.html https://keepass.info/help/kb/pw_quality_est.html - Overview of Diceware for hand generating pass 'phrases': https://theintercept.com/2015/03/26/passphrases-can-memorize-attackers-cant-guess/ https://theintercept.com/2015/03/26/passphrases-can-memorize... --- 1. TL;DR quote from TechNet: - Password lengths are significantly more important than password complexity requirements - Password complexity only prevents users from creating easy-to-guess passwords - Password complexity actually reduces the total number of possible passwords in a key-space - In theory, the most secure password policy would define a longer-length password with no other complexity requirements with a very large dictionary that consists of all easily-guessable passwords