12 characters, upper/lower/special requirement, and no more than two occurrences of the same character together. That’s FedEx.
Two other thoughts on the topic:
- Websites/apps/etc should always list their password requirements on the login page to make it easier to determine what password you used for the site in question.
- There are plenty of websites where I literally log in only by using the “forgot password” flow because their password requirements are so ridiculous.
/c/dadjokes is over there ->