Password Strength Recommendations for 2023?

Here is what I know from NIST publications and some internet searching.

1. Password length > complexity. Length absolute minimum at 8 characters long, ideally 12 characters or higher, max limit at 64 characters (to avoid server processing issues).
2. Great but not necessary to have symbols, numbers, lowercase and uppercase as long as all other rules are followed. This mainly applies to applications outside of work or high security requirements, of course.
3. Never just dictionary words, birthdays, house …

cybersecurity password password strength recommendations strength