@gsuberland Also used to be 8 characters, and shouldn't be
a word. (I think this was some truncation thing.)
Now, the recommendation is split among those wanting to use a few words in a row because it's technically harder to brute force, and those who want your small password to have special characters (but not provide emoji support)