Letters, numbers, and . - _ — not at the start or end.

At least 8 characters, mixing two of: upper case, lower case, numbers, symbols. Any symbol will do.