Interesting thread here about latest NIST password recommendations.

Big NIST milestone: passwords should accommodate 64+ chars, not force special/symbols, not force arbitrary changes, forms should allow paste
Kenn's tweet

link;

Special Publication 800-63
Read NIST’s Digital Identity Guidelines!