- Can't be too similar to your other personal information.- Must contain at least 8 characters.- Can't be a commonly used password.- Can't be entirely numeric.