I sure hope people aren't actually using passwords of length 12-characters or fewer. Why not allow longer strings?

Then again, the perennial popularity of passwords like '123456' and 'password'...