A new password must:
- Be at least 12 characters.
- Not appear in a known data breach — we check without ever sending your password anywhere.
- Not contain your own name or email address.
- Not be an obvious pattern like 1234 or aaaa, or a common word.
We do not demand a capital, a number and a symbol. Those rules tend to produce predictable passwords like "Password1!". A long phrase you can actually remember — four or five unrelated words — is both easier and stronger.
Existing passwords keep working. These rules apply when you set a new one.