Use at least 8 characters. Passwords are stored only as salted bcrypt hashes and checked against known breach lists.