Any length and any character is a nice idea, but given an incompetent developer on the other side it can get worse. E.g. a frequent snippet you can find on the

Any length and any character is a nice idea, but given an incompetent developer on the other side it can get worse. E.g. a frequent snippet you can find on the web for hashing a string in .NET uses things like Encoding.Default or even Encoding.ASCII. Those then change every Unicode character silently to a question mark, making a lot of potential passwords identical. Normalisation should also be considered and rarely is.