Must be at least 8 characters long, not match your email, and not be compromised in known data breaches.