It happens that I setup the minimum password complexity to 2 and user are not able to use password like Ulllll#n
U mean an uppercase
l mean lowercase
# a special char
n a number
I managed to get the green flag at 16 characters.
Sounds like the 2 complexity level is a bit overkill