Passwords must be at least 8 characters long and not commonly used.