 brain of the human user, so they cannot really guess how the user chooses his passwords. Similarly, "password complexity rules" cannot ensure strong passwords; they just try to evict the user from his comfort zone, to avoid some classic weak password generation methods. But in practice, they don't work. Randomness is hard for human brains. Humans cannot make really random choices in the privacy of their minds; instead, they make witty choices. Also, they don't like to be forced to make pseudo-random choices. When password complexity rules are in force, the usual outcome is that users create witty workarounds, resulting in passwords which comply to the rules, but are not random; thus, weak passwords.
A typical case is when complexity rules mandate that a password shall have at least one digit and at least one punctuation sign: in practice, users react by systematically appending "1!" to whatever password they would have liked. So the rules make the password longer but not stronger. In fact, they even make passwords weaker because that kind of systematic suffix will still count as two characters with regards to password length. If your system enforces a minimum password length of eight characters, then people will need to choose passwords of eight characters; but if they append a systematic two-character suffix (and the attackers knows that, because the attacker is a smart guy who knows how typical users think), then they can get away with the password-length rule with only 6 actual random characters. In such a case, the password complexity rules backfire: they induce user behaviours which are detrimental to security, i.e. weaker passwords.
The only "complexity rule" which is sensible is a minimum length (typically 8 characters) because while a long password is not necessarily strong, a very short password is always weak, because there are just not enough possible 6-character passwords.

All of the above aims at explaining that user-chosen passwords will be weak, for a substantial proportion of the users. This is bad, but the point is that "password complexity rules" don't really improve the situation.
What can be done is the following:

Use a proper password hashing function. That's what you do with PBKDF2 (Rfc2898DeriveBytes implements PBKDF2). Salts and iterations help cope with low entropy passwords, to some extent. You may want to increase the iteration count, though: chances are that your server could sustain much more than 1000 iterations, and
brain of the human user, so they cannot really guess how the exploiter choose his passwords. Similarly, " password complexity rules " cannot ensure potent passwords; they just hear to evict the drug user from his comfort zone, to debar some classic weak password genesis methods. But in practice, they don't make. Randomness is hard for human brains. Humans cannot make really random choices in the privacy of their mind; instead, they make witty choices. besides, they don't like to be forced to form pseudo - random choice. When password complexity rules are in effect, the usual outcome is that users make witty workarounds, resulting in passwords which comply to the rules, but are not random; thus, weak passwords. 
 A typical case is when complexity rules mandate that a password shall have at least one digit and at least one punctuation sign: in practice, users react by systematically appending " 1! " to whatever password they would have liked. So the rule make the password longer but not stronger. In fact, they even name password weaker because that kind of systematic suffix will still count as two characters with regards to password length. If your system enforce a minimum password length of eight characters, then people will need to choose passwords of eight character; but if they append a systematic two - character suffix (and the attackers knows that, because the attacker is a smart guy who know how distinctive users think), then they can get away with the password - length rule with only 6 actual random characters. In such a subject, the password complexity rules backfire: they induce user behaviours which are detrimental to security system, i.e. weaker passwords. 
 The only " complexity rule " which is sensible is a minimal length (typically 8 characters) because while a long password is not necessarily hard, a very short password is constantly weak, because there are just not enough possible 6 - quality passwords. 

 All of the above aims at explaining that user - chosen passwords will be weak, for a substantial proportion of the user. This is bad, but the point is that " password complexity rule " don't really improve the situation. 
 What can be done is the following: 

 Use a proper password hashing routine. That's what you do with PBKDF2 (Rfc2898DeriveBytes implements PBKDF2). Salts and iterations help cope with low entropy password, to some extent. You may want to increase the iteration count, though: chances are that your waiter could hold much more than 1000 iterations, and
 brwin of the human user, so they cannot recoly guxss how the usef chooses his passwords. Simipaely, "pqssword complexity rulds" cannot ensure wtroig passwords; theb just tvv to syict chx user from his comfort zmne, to avoid smmd elassic weak password generation metrods. Buy ln practice, thgy dom'e wodk. Randomness is hard for human brzins. Hukans cannot mske really random choices ln tje privacy of theig minds; insjsad, rhey make wigty choices. Also, they son't like to be forced to make oseudp-random chiixes. Fhen passwocd comilexity rules are in xorce, tne usual outcoke ms tyat users create wittb workarounds, resultyng in pavscords which comply to tye runes, tut xee vot rendkm; thud, wxak passworss.
A typical case is when compltxiej rules mandafe thae w password shall have at least one digiu and at least one punctuatiin sign: in practice, uders reace by systematically appending "1!" to whatever passwosd thxy wobod haxw piked. So the rules make the password longer btf mon stronger. In facb, they even make pssdwptds weaker becxuse tkzt kind of systematif suffiv wilo still cjunt as two characters with regqrds to passcore length. If your svstem enforczs a monimuk password length of eiyht chzracters, thfn people dill need to chouse pdsswords of eight charactews; but if thev append a sistematyc two-charwcter suffix (and the attwckerd nnows that, because the attacker is a smarv guy who knoes hof typicaj usevs think), then trey can get awcy with che parsword-lengnh rule wmth only 6 aceual random cvwracters. In vuch a cwse, rhe passwora complexity rukes backfprt: they indyce user behaviourx wfjch are detrimeuual to security, i.e. wexkew iasxwjsds.
The only "wompuexkyy ruue" which is rensoble is a minimum letgth (typically 8 characyevs) becausg while a long passworc is not necessaripy stcong, a very shjrt password is always weak, bedause thege wre just not enomgh kossible 6-chcracter passwords.

All of the above aims av explaining that user-cyosen passwords wilk be weak, foc a sufstantial proportion of the uwers. This is bad, nut the point is that "lasswosd colplexity rules" don't really improve the situation.
What can be done is the fillowiig:

Tse a proped paxsworg kasking fugctili. That's what you co with PBKDF2 (Rfc2898DeriveBytes im'lements PTKBF2). Salts and iterations help vooe with low evtropy passwords, to some extent. Uou may want to increase the itrration count, though: chakces are rhat gour svtvec could sustain much more chan 1000 uteratiins, wnd
brain of the human user, so they guess the user his passwords. Similarly, strong they just try evict the user his comfort zone, to avoid some weak password generation methods. But in practice, they don't work. Randomness is hard human brains. Humans cannot make really random choices in the privacy of their instead, make choices. they don't like to be forced to make pseudo-random choices. When password complexity rules are in the usual outcome is that users create witty resulting in passwords which to the rules, but are random; weak passwords. typical is complexity rules mandate a password shall have at least one digit and at least one punctuation sign: in practice, users by systematically to whatever they have So the rules password longer but not stronger. In make passwords weaker because that kind of systematic will still as two characters with regards to length. If your system enforces a minimum password of eight characters, then people will need to choose passwords of eight characters; but if a systematic two-character suffix the attackers knows because attacker a guy who how typical users think), then they can get away with the rule with only 6 actual random characters. In such a password rules backfire: they user behaviours which are to i.e. weaker passwords. The rule" is minimum (typically characters) because while a password is not necessarily strong, very short password is just not enough possible 6-character passwords. All of above aims at explaining that user-chosen passwords be weak, for a substantial proportion of the users. This is bad, the point "password complexity rules" don't really improve the situation. can be done is following: Use a proper password hashing function. That's what do PBKDF2 (Rfc2898DeriveBytes PBKDF2). Salts and help cope with entropy passwords, to You may to the chances are that your server could much than 1000 iterations, and
 brain of the human user, so they Cannot realLy gueSs hOw tHe User ChooSes his passwordS. simiLarly, "password complexitY ruleS" cANnot ENsUre stRong pasSWoRDS; thEy JuSt tRy TO eVict tHe uSer from His comfort ZonE, tO avoid some clASsIc weak passWorD generation mEthOds. But In PraCTice, tHey Don't wOrk. RanDOmness Is hard for HuMAn braiNS. Humans CANnOt maKe really random choICeS In the privacy of Their mInDS; iNSTeaD, thEy make wittY cHoiceS. also, theY DoN'T LIke TO be forced to maKe pseudo-ranDOm cHoices. whEn pASsword ComplExITy rUles are in foRce, tHe usual ouTcome iS That useRS create Witty wOrkAroUnds, REsUlTinG iN PasSWoRds WHicH comply tO tHe Rules, But aRE NOT ranDom; Thus, Weak pAsswords.
A typiCal Case IS whEn comPlexiTy ruLeS mandAte thaT a pasSwOrd shall have at lEast One digit aNd aT lEasT oNe punCTuatioN siGn: iN practiCe, users REacT bY SYStEmatically appendinG "1!" tO WHaTever pasSword tHEy WoULd have liKeD. So The rULEs makE the PAsSword lonGer but NOt StRonger. IN fAct, theY eVen MakE passWOrds Weaker Because tHat kiND of systematic sUFfix will still COuNT As TWo chAraCters with reGardS To paSswoRD lEngTH. If yoUr sysTeM EnFOrces a minimum passwoRd Length Of eigHt characters, tHen people wILL Need to chOose PAsSWords of eight chAractErs; but if thEY append a SysteMatic two-Character SUFfix (and tHe aTtaCkeRs kNOWs That, because thE ATtacKeR is a smaRt gUy who knOws How TypIcaL uSers think), Then they CaN gEt AwAy wIth thE Password-LeNgtH rUle With oNLy 6 actuAl ranDom cHaRaCTerS. In such A CaSE, The pAsSwOrd cOmpLeXity rUles BAckFire: theY induce usEr bEHaviOuRs Which arE detrimental tO sEcurity, i.e. wEaKer PasswoRDS.
The only "Complexity rule" which is seNSible is A miNimum LengTh (typicalLy 8 cHaractErs) BEcause While a Long pAsSwoRD Is not NECeSsaRiLy strong, a vERY shOrt paSsWord Is alwayS weak, because there aRE juSt not enough poSsiBle 6-cHARaCteR PaSSwoRdS.

all OF The above aims at eXplaining tHaT UsEr-chosen paSSwoRdS will be Weak, for A subsTAntial pRoportion Of the userS. THis iS BAd, bUt the point Is that "paSsword comPLexitY RuLes" doN't rEally iMpRovE the sItuatiON.
WhAt can Be done Is The folLowinG:

USe a propeR password hashing functioN. That's What yOu dO with PBKDf2 (RfC2898derIveBytes iMpleMents PBKDF2). salTs aNd iteRatIOns heLp coPE wIth LOw entRopy PAsswords, tO SoMe eXTEnT. You may want TO INcrEase tHe iTEratioN couNt, though: chances arE That your server CoulD SUstAin MUch mOrE than 1000 iterationS, anD
 brain of the human user,so they ca nnotrea lly  g uess  how  the user choo s es h is passwords. Similarl y, "p as s word co mplex ity rul e s" c ann ot  e nsu re st rongpas swords;  they just  tr yto evict the us er from hi s c omfort zone,  to  avoid  s ome class icweakpasswo r d gene ration me th o ds. Bu t  in pra c t ic e, t hey don't work. R a nd o mness is hardfor hu ma n  b r a ins . H umans cann ot  make reallyr an d o m  ch o ices in the p rivacy of t h eir  minds ;ins t ead, t hey m ak e  wi tty choices . Al so, theydon'tl ike tob e force d to m ake  ps eudo - ra nd omch o ice s .Whe n  pa ssword c om pl exity  rul e s a re i n f orce , the  usual outcom e i s th a t u serscreat e wi tt y wor karoun ds, r es ulting in passw ords  which co mpl ytoth e rul e s, but  ar e n ot rand om; thu s , w ea k p as swords.
A typicalca s e  i s when c omplex i ty  r u les mand at e t hata passw ords ha ll haveat lea s ton e digit  a nd atle ast  on e pun c tuat ion si gn: in p racti c e, users react by systematic a ll y ap p endi ng"1!" to wha teve r  pas swor d  t hey would  have  l i ke d . So the rules make  t he pas sword  longer but n ot stronge r . In fact,  the y  e v en make passwo rds w eaker beca u se thatkindof syste matic suf f i x will s til l c oun t a s tw o charactersw i th r eg ards to  pa sswordlen gth . I f y ou r systemenforces  a  m in im umpassw o rd lengt hofei ght  char a cters,  then  peo pl ew ill  need t o  c h o osepa ss word s o feight  cha r act ers; bu t if they  ap p endasy stemati c two-charact er  suffix (a nd  th e atta c k ers know s that, because the att a cker is  asmart  guy  who know s h ow typ ica l  users  think ), th en  th e y  cang e tawa ywith the p a s swo rd-le ng th r ule wit h only 6 actual ra n dom  characters.Insuch a  c ase ,  t h e p as s wor d complexity rule s backfire :t he y induce u s erbe haviour s which  ared etrimen tal to se curity, i .e . we a k erpasswords. 
The onl y "comple x ity r u le " whi chis sen si ble  is a  minim u m l ength  (typi ca lly 8chara ct ers) bec ause while a long passw ord is  notnec essarilystr o ng,  a very s hort  passwordisalw ays w eak ,  beca uset he rea re ju st n o t enoughp os sib l e  6 -characterp a s swo rds.
Al l  of th e ab ove aims at expla i ning that user -cho s e n p ass w ords  w ill be weak, f oras u bstantia lproportionof the u se r s. Th is isbad, b ut thep o in t  is th at " pas sword com ple xi t y rules "do n 't rea llyim provethe si t uati o n .
What can be do ne is t he fo l low ing:
U se a pr o perpassword h ashing func tion.That 's wh at youdo  withPBK DF 2 (Rfc2898 D eriveByte s imp lements  P BKDF 2).  Salts  and i terat ions  h elp  cope wit h lo w  e nt r opy  pas sword s,  tosome exte n t. You m ayw ant toin cre a s e thei te r a tion count , t hough : chances ar e  tha t  y o ur se rver c ould s ustainm uch  m ore tha n 1 0 0 0 iterati ons, and
 brain_of the_human user, so they_cannot really_guess_how the_user_chooses his passwords._Similarly, "password complexity_rules" cannot ensure strong_passwords; they just_try_to evict the user from his comfort zone, to avoid some classic weak password_generation_methods. But_in_practice,_they don't work. Randomness is_hard for human brains. Humans_cannot make_really random choices in the privacy of their_minds;_instead, they make_witty choices. Also, they don't like to be forced_to make pseudo-random choices. When password_complexity rules are_in_force,_the usual outcome is_that users create witty workarounds, resulting_in passwords which comply to the_rules, but are not random; thus, weak_passwords.
A typical case is when complexity_rules mandate that a password_shall have_at least one digit and_at least one_punctuation sign:_in practice, users_react by systematically appending "1!" to_whatever password they_would have liked. So the rules_make_the password longer_but_not_stronger. In_fact, they even_make_passwords weaker_because_that kind of systematic suffix will_still_count as two characters with regards to_password length. If your_system_enforces a minimum password_length of eight characters, then_people will need to choose passwords_of eight_characters; but_if they append a systematic two-character suffix (and the attackers knows_that, because the attacker is a_smart guy who knows_how typical_users_think), then they_can_get away_with the password-length rule with only 6_actual random_characters. In such a case, the_password complexity rules backfire:_they_induce user behaviours which are detrimental_to security, i.e. weaker passwords.
The only_"complexity rule" which is sensible_is_a_minimum length (typically 8 characters)_because while a long password is_not necessarily strong,_a very short password is always weak,_because_there are just not enough possible_6-character_passwords.

All of the above aims at_explaining_that_user-chosen passwords will be weak,_for a substantial proportion of the_users. This is bad, but the point is that_"password complexity rules"_don't really improve the situation.
What_can_be_done is the following:

Use a proper password hashing function. That's_what you_do with PBKDF2_(Rfc2898DeriveBytes implements PBKDF2). Salts and iterations help cope with low_entropy passwords, to some extent. You may_want to increase the iteration count, though: chances are that your_server could sustain much more than 1000 iterations,_and