3–32 characters — lowercase letters, numbers and underscores.
Use 8+ characters. Avoid common passwords and your own name.