Letters, digits and @ . + - _ only. You can change it later.
At least 8 characters, not all numbers, and not a common password.
or