IMHO almost all organizations have terrible password policies. There are only a few requirements for a good password: 1. The password must be difficult to the

IMHO almost all organizations have terrible password policies. There are only a few requirements for a good password: 1. The password must be difficult to the point of impossible for a computer to guess. 2. The password must be memorable enough that a person can create it once and then remember it a month later. If you don't satisfy requirement #1 then it will be hacked with a GPU farm. If you don't satisfy requirement #2 then the users will undermine your security in a multitude of ways. Almost no corporate password policy attempts to address or even facilitate option #2. They don't even mention it! Many corporate password policies are actively hostile to option #2, requiring a bunch of stuff that's hard for people to remember but only reduce the search space for the computer farms attacking your leaked password database. I like to use phrases made of things that sound like words, but aren't in the dictionary. Make them themed to be memorable. I call them Jabberwocky passwords. Were it not in famous poem a good password would be "mimsy were the Borogroves".