Password Requirements of SaaS

Hello,

On occasion, I stumble upon password requirements of some services that doesn't seem up to date with the latest recommendations.

They often limit the number of total characters, the character set to use or even require a password schema.

I might be wrong, but my feeling is, that those "requirements" in fact create weaker passwords or passwords that are easier to calculate/guess.

Last time I encountered these requirements:

• Min: 12 chars, Max: 16 chars
• Starting with 5 numbers
• Must contain at least one uppercase, one special char (from a list of allowed characters)

What is obvious to me is that by limiting the number of total characters you limit also the complexity. You also do the same by limiting the set of characters you can use.

What I am not sure about is this: If your schema has to start with 5 numerical characters, isn't the total complexity also reduced drastically?

I assume with 16 characters you have:

• First 5 characters must be within [0-9]
• Next 11 characters must be within [a-z, A-Z, 0-9, some special chars]

Is this effectively reducing the complexity to basically 11 characters of a password, because the first 5 numerical characters can be guessed within milliseconds nowadays?

How would you rate a password requirement like this?