This question already has an answer here:
Assuming the use of bcrypt/scrypt:
Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical 8-character-minimum uppercase/lowercase/special char pass requirement?
It seems like there is a tradeoff between ease of memory and how difficult something is to brute force, and not everyone uses (or wants to use) password managers.
What's the best solution in practice? I don't know what password requirements to set for my users. Having requirements that are too complex give users an incentive to make easy-to-remember passwords, whereas requirements that are too lenient give users an incentive to be lazy and make passwords that are weak to brute force.