Spot On! Do not limit everyone.

Its good practice to use secure passwords that are a mixture of letters, numbers, and punctuation. Got that. Its good practice to not use familiar words. Got that. It is good practice to have different passwords for each site. Got that. It is good to make passwords as long a possible. Got that. Great! I have 167 different passwords using random characters, each 20 bytes in length. Oh. Did I forget. You shouldn't write down your passwords, either. AWESOME! At work I use the same 8 character password across all servers and mainframe so I only have to remember one. It comprises upper lower characters, numbers, and punctuation. Each character is typed switching hands, so right left right left, and so on. And it changes every 45 days. At home, I use four or five variants of the same complex password that is 14 characters in length. I think I'm good until some site is hacked and its all exposed.