I like the rule that Nextcloud uses by default: rather than requiring character class minimums or anything like that, it makes sure that the password you picked isn't one of the top 1,000,000 most commonly used passwords.