Rules like "At least one special character" are silly. But I like estimator (e.g. zxcvbn) based strength requirements. Plus checks against blacklist like hibp.