At least 8 characters. Must not be a common or breached password.