Dutch Tax Authorities (Belastingdienst) Website→

At least 8 and at most 25 characters, of which at least 3 of the characters were not used in the previous password. No more than 3 of the same characters. At least 1 upper case and 4 lower case characters. No more than 3 special characters.

It's not like hashing passwords is a thing or something.