policies require a minimum password length. Eight characters is typical but may not be appropriate. Longer passwords are generally more secure, but some systems impose a maximum length for compatibility with legacy systems. Some policies suggest or impose requirements on what type of password a user can choose, such as: the use of both upper-case and lower-case letters (case sensitivity) inclusion of one or more numerical digits inclusion of special characters, such as @, #, $ prohibition of words found in a password blocklist prohibition of words found in the user's personal information prohibition of use of company name or an abbreviation prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers Other systems create an initial password for the user; but require then to change it to one of their own choosing within a short interval. Password block list Password block lists are lists of passwords that are always blocked from use. Block lists contain passwords constructed of character combinations that otherwise meet company policy, but should no longer be used because they have been deemed insecure for one or more reasons, such as being easily guessed, following a common pattern, or public disclosure from previous data breaches. Common examples are Password1, Qwerty123, or Qaz123wsx. Password duration Some policies require users to change passwords periodically, often every 90 or 180 days. The benefit of password expiration, however, is debatable. Systems that implement such policies sometimes prevent users from picking a password too close to a previous selection. This policy can often backfire. Some users find it hard to devise "good" passwords that are also easy to remember, so if people are required to choose many passwords because they have to change them often, they end up using much weaker passwords; the policy also encourages users to write passwords down. Also, if the policy prevents a user from repeating a recent password, this requires that there is a database in existence of everyone's recent passwords (or their hashes) instead of having the old ones erased from memory. Finally, users may change their password repeatedly within a few minutes, and then change back to the one they really want to use, circumventing the password change policy altogether. The human aspects of passwords must also be considered. Unlike computers, human users cannot delete one memory and replace it with another. Consequently, frequently changing