Interesting thread on different approaches. My employer requires a 15 character password for domain access, changed every 60 days.
The site that I have to use requires a change every 90 days, and must not use eight characters, numbers, from previous passwords.
It’s a government webpage.