Here is a little tip that you can share with your respective user communities when trying to enforce a good password policy – i.e. complex and changing every 30 days
In my experience, a change to a tighter password policy results in kick-back and often an increase in calls to helpdesk for password resets, etc. One simple tip you might want to share could help both meet your requirements and enable users to remember their password more easily.
First off, suggest that they think of their favourite song, book, film, etc. and choose the first two words from a favourite quote/lyric. Then substitute vowels o, a, e, i with 0, 4, 3, 1. Then capitalise the first or last letter of one of the words. Finally, seperate the two words with a symbol such as +, -, *, /, or =
So, using the first two words of Bob Marley “3 little birds” (i.e. Don’t worry), would give:
Now, given that the password policy is change every 30 days, all the user has to remember is to change one of the symbols so after one month, d0nt+w0rrY becomes d0nt-w0rrY and so on
All the user has to get used to is this philosophy, they then only need to remember a single character change and they could even rotate this to overcome the requirement not to re-use the same password within 3 changes. The 2 main words that are personal to them are (arguably) easier to remember, so hopefully this can tick the opposing challenges of strict password policy and obstructive/clueless users.