At least 8 characters, with uppercase, lowercase, and a number.
Two-factor authentication can be enabled later in account settings.