I know it's been 3 years but this needs a refresh.
As long as you've set up enough connection protection (block after 3 wrong attempts for example) you're safe. As long as the database doesn't leak. But if the database is hacked, you're almost dead.
Take this password
Lov3t©cöde looks cool, doesn't it? It contains:
- Lower case char;
- Upper case char;
- Special char.
And is 10 characters long. Looks great. But with nowadays GPU power and a few thousand dollars, you can break it within a week. You don't trust me? Try it.
What I would recommend is a passphrase. Something that you can remember, because what's the point it you have to write it down on a text file?
Take an easy sentence:
I eat chocolate at night!
add entropy to it:
Congratulations! You now have a 22 long password that would take around 1.04 hundred million trillion centuries to break, which you can remember! (Because the complexity space is
95^22. If you allow a set of 33 special char, which makes
~3.27 x 10^43. Assuming one hundred trillion guesses per second, it will take my 1.04 hundred million trillion centuries.)
Great, what could be better? Allow users to connect through them google/facebook/whatever accounts. Then you'll never have to worry about your password policy.