I would use different requirement: 1. The maximum password length should be high; perhaps at least 127 characters, possibly more. The minimum password length s

I would use different requirement: 1. The maximum password length should be high; perhaps at least 127 characters, possibly more. The minimum password length should not be less than 5 or greater than 8. 2. Passwords should be allowed to contain any non-null bytes (0x01 to 0xFF). Do not check if they are valid characters or check for bad words or anything like that; any sequence of bytes should be acceptable, and it should not "normalize" them. Passwords must be case-sensitive. 3. The hashes of passwords should be stored rather than the password by themself. Passwords might also each have their own salt, or use other data in the hash such as the user name, or both. 4. You should never be required to change your password after any amount of time, but should be allowed to change it whenever you want to do. 5. Do not use "security questions" such as mother's maiden name etc. 6. When creating or changing the password, ask for the password twice. 7. Depending on the user interface, you may wish to check for common mistakes such as entering data that is probably meant to be somewhere else (such as an email address or user name), but you should accept it anyways if the user insists that it is correct. 8. In the case of multiple incorrect logins in a short interval, you should prevent further logins. Depending on the specific system, there may be some exceptions, in order to prevent someone from stopping legitimate users from logging in. 9. Other methods of authentication may be possible for some systems e.g. HMAC, public/private keys, X.509 certificates, etc. 10. When designing the user interfaces, tell the renderer that it is a password field (in a HTML form, you would use <input type="password">), and the client software may be able to be configured to show or hide the password according to your preferences (as well as what font to use).