Must be at least 12 characters and include upper, lower, number, and symbol. Checked against known-breached password lists.