To get into our payroll system we have to use a 12 digit password that changes once a month and the password cannot have 4 digit combination that is the same as any of the previous 20 passwords.
Example: if you have abc1 anywhere in your password, that cannot reappear for 20 pws.
That's aggressive, but I kinda get the caution with payroll systems. I have some really menial websites we use that are over the top with their security. Since they aren't shared, I generally have fun with them.
I learned an object lesson one day when the owner asked for my log-on and password so he could access something. I gave him my log-on and the spelled out my password for him: s-u-c-k-s-t-h-e-b-i-g-1-!
I've tempered my frustration with passwords since then.