Must include uppercase, lowercase, number, and special character (e.g. !@#$). Avoid common passwords.