Bear in mind that your users are creatures of habit, and can
only remember a limited number of passwords. Many users will
simply capitalize the first letter, put a number at the end, or append
a ! to their password, when asked to make it more
complex.