•be between 8 and 12 characters
•contain a combination of letters and numbers
•not contain spaces or the word 'password'
•not contain three adjacent letters or numbers the same (eg 'aaa' or '999')
Banning "password" and runs of identical characters makes sense, but why the ban on spaces? And why is there ever a need for a maximum password length?
(elemnar, guess what I've just been doing?)