What we actually require:
at least 8 characters
15 or more is much stronger
not found in a known data breach
A few random words you can remember beats a short
password with symbols in it. We check every password against known breaches
— your password itself never leaves this server.