Passwords need a minimum length: NIST now asks for at least 15 characters when the password is the only login factor. Many sites require mixed case, numeric characters, or special symbols in an effort to encourage less guessable passwords.