NIST now recommends using long passphrases instead of complicated alphanumeric passwords, and only refreshing them if they've been breached.

Some Web sites only allow alphanumeric characters (letters and numbers) in their passwords. This invites bad passwords, lowering security for everyone.