Because of minimum age rules, I just spell out the number if I can't recycle the old password yet.

One of the reasons I don't do IT security any more is the attachment to old dogma like these kinds of password rules by auditors - they are the real barrier to making policies more effective.