- 8 character minimum
- The ability to use all special characters but no special requirement to use them
- Restrict commonly used passwords
- Restrict passwords obtained from previous breach corpuses
For the last bulleted requirement, see the next section.
When completing creation of your account (or updating your password), you may see a warning about your password appearing in compromised accounts on other sites. When setting/updating your password, we check your entry against a database of compromised passwords. This database contains over half a billion real world passwords previously exposed in data breaches across the internet. If a password you enter matches a password that has been previously exposed over 1,000 times, you will be asked to choose a new password (and you should immediately change your password on any other sites where you may have used that same password).