So far https://studentaid.gov/ is the worst I've come across (I don't want to enter fake info^ and I can't duplicate my account to double check the requirements). From memory it was something like:

1) No words! 2) Can't reuse last 24 passwords 3) Excludes some special characters 4) 5 Security questions 5-10) Several other password requirements

Are the security questions case sensitive? Who knows.

^ "I understand that I’ll be required to certify that the information I provide to create an account is true and correct and that I’m the individual I claim to be. If I’m not the person I claim to be, I understand that I’m not authorized to proceed and that I should exit this form now. If I provide false or misleading information, I understand that I might be subject to a fine, prison time, or both."