Comment by andybak

The official NSA advice for several years has been "do not enforce restrictions on characters in passwords".

It's simple to calculate the actual entropy and check against a list of common weak passwords (large lists are easily obtained and kept up to date)