Your password policy should be such that passwords are:
User-generated
Length and Complexity:
are at least 12-16 characters long and
include a mix of uppercase and lowercase letters, numbers, and special characters.
Avoid Common Words and Patterns like "password," "123456," or sequential keyboard patterns like "qwerty."
Two-Factor Authentication (2FA): Implement two-factor or multi-factor authentication for an additional layer of security.