Agree almost entirely (that password composition rules are outdated, and NIST agrees).

Though if you're talking about password attacks that are true brute force (nothing known about the password at all, word list and other attacks exhausted, so falling back to trying every single possible character) ... the math of 16 characters may be bigger than intuitive.

To give you an idea, let's start with 13 characters. Assuming the full printable ASCII character space, and an astronomical hash rate like a trillion hashes per second, it would take 1.6 million years to truly bruteforce 13 characters:

wolframalpha.com/input?i=%2895…

So bruteforcing 16 random characters would be 95 * 95 * 95 of 1.6 million years. Which is probably overkill. 😉

Of course, if we're not talking about passwords based on randomly generated individual characters, but instead about passphrases, this math shifts. But the math is always the number of possibilities to the power of how many of them were chosen. For passphrases, this is (size of dictionary to the power of the number of words). So five words from a 20,000 word dictionary would take a modest 100 years to guarantee a crack (fully exhaust), with an average time to crack of 50 years.

wolframalpha.com/input?i=%2820…

So the password would be dramatically longer than 15 characters, and quite a bit less strong, but still suitable for many use cases. (But if it was stored with a fast hash like MD5, it would only take six 4090s to hit that hash rate! So with all the GPU compute likely available to private attackers, probably not enough if you are a high value target)

Hopefully, those reading along can see why simple composition rules (that you are correctly railing against) wouldn't map as well to a passphrase.

(People may also have questions about quantum photography. My awareness is weaker here, but my understanding is that relatively modest strengthening of password strength is enough to compensate, and wouldn't make an appreciable dent in the astronomical time scales described above.)

my favorites are the sites that require short passwords, but allow long usernames

"Sorry bejhodBed|OnmyivwautatVekDoQuavTakyilryg!SluffEm, passwords must be no longer than 12 characters.[0]"

[0] which implies "Please use another company because our security is insufficient."