I disagree with such rules. Case to make a point. The following password:
correct_horse-battery_stapler
does not satisfy half of the typical rules of a strong password but it's extremely hard to brute force. Even harder to brute force:
correct cheval Batterie συρραπτικό
Combining four languages. Try brute forcing that with JtR or HashCat. It will take you months IF you have full dictionaries for all four languages and you suspect that the user may have used proper words. You get the idea.
So, what is a strong password? Not the typical password looking like line noise which is impossible to remember. A strong password is one which you can remember and is complex enough to make brute forcing counter productive. Putting automated rules for that? Good luck :)
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!