passwords

NIST Special Publication 800-63, titled Digital Identity Guidelines sets requirements for federal agencies implementing digital identity services. It's probably a good set of guidelines for civilians too. Probably best to just duckduckgo "NIST password requirements YYYY"

https://csrc.nist.gov/publications/detail/sp/800-63/3/final