On a forum thread that ran dozens of pages, someone wrote:
Password must be 8-20 characters and contain letters and numbers