At least 8 characters. Stored only as an encrypted hash.