I think arbitrary password rules (must have number, letter, special, etc) are harmful. Use length only (10+), with min unique chars.