There are guidelines for just passwords that don't involve MFA. Very important ones few people do, because it is not trivial to implement.

- No password that is part of a leak. It requires maintaining a database, or using an online service.

- No upper limit on length and character set. It requires full Unicode support and proper string processing.