Why would you assume that? A site's password requirements are public information, so you should expect an attacker to read them.