There's a difference between non-complex and guessable. You don't need to have a 16+ character password to make it non guessable. My comment was referring to brute forcing rather than guessing...