This is what other people see. 3–20 characters, letters, numbers or underscore.
At least 8 characters. Avoid names and common passwords.