It’s important to start with a clear disclaimer:
Password must be 8-20 characters and contain letters and numbers