Must be at least 12 characters with uppercase, lowercase, number, and special character. Avoid common passwords.