NIST guidelines discourage password policies that require multiple character sets.
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets.
It also explains why.
I'm currently lobbying within my company, which is primarily a B2B, to adhere to this guidance but experiencing pushback based on the argumentum ad populum that it is "industry standard".
Just judging from memory I can recall that several websites have required multiple character sets, but right now the only ones I can find are Microsoft and StackOverflow 😂.
What are some major websites that I can cite as examples that adhere to the above NIST guideline of not requiring multiple character sets?