Must include:

• 8 characters
• 1 uppercase letter
• 1 lowercase letter
• 1 number
• 1 special character (excluding %)

Must exclude:

• Commonly used passwords (e.g. password)