Is there data on the most common password strength requirements?

Question

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common:

• Password must contain a mix of upper and lower case letters
• Password must contain at least one number
• Password must contain a special character like ()*&^%$£"- etc.
• Password must be longer than 8 characters

I'm wondering what the most common requirements set by everyday websites are. Obviously this is impossible to answer definitively given the number of websites on the internet, but I'm wondering whether anyone has collected some amount of data gathering the modal password strength requirements? I was not able to find this from Googling.

Answer 1

... but I'm wondering whether anyone has collected some amount of data gathering the modal password strength requirements?

A Second Look at Password Composition Policies in the Wild: Comparing Samples from 2010 and 2016 from Usenix 2017 has collected password policies and strength requirements from many web sites. In this paper you'll find also links to related papers.