Increasing the iterations is basically free (up to the point where it requires human-noticable amounts of time to calculate), so there's no need to require 4 mo

Increasing the iterations is basically free (up to the point where it requires human-noticable amounts of time to calculate), so there's no need to require 4 more characters. Also, teaching users enough of this to do it well is basically impossible. You have to have a threat model that includes your users being fairly shit at passwords. Especially when your product is solving the problem of users being shit at passwords.