8–20 characters. Include a lowercase letter plus an uppercase letter, number or symbol (!@#$%^&*).