Comment by modeless

Or, you could just do what NIST recommends and not impose arbitrary password requirements beyond being 8+ characters and and not appearing in a list of known passwords. https://pages.nist.gov/800-63-3/sp800-63b.html#:~:text=no%20....