12 characters minimum. It is checked against known breaches, so a password you have used elsewhere will be refused.
