We require 16 characters, and we hash check all passwords against the haveIbeenpawnd database. We removed the regular expressions with normalization and fuzzy logic because almost all of the password combinations already exist in the database. We had lots of complaints about the difficulty in picking a password, so we also created a mechanism which explains why a password fails validation.