Ditto Pavel's answer,The minimum requirements are that it passes the zxcvbn library's strength check. I don't think therecan't see a simple summary of their rules. This is registered as script 'zxcvbn-async' that you can enqueue / make a dependency of your own scripts, and then you can run the check yourself on the client-side. See password-strength-meter and user-profile.js's multiple cases for zxcvbn being not-yet-loaded.
Nowadays WordPress encourages you to use randomly generated passwords
- new user registrations always have a randomly generated password
- to change your password in the admin site you click 'generate password' to get a new random one, butone; it does give you the chance to override it but will disable the 'Update profile' button on the page until your password has passed a zxcvbn check.
AsThis is only enforced on the client-side though; there's no server-side enforcement as far as I can see the only place in the back-end that there would be a password strength check is. here in wp-admin/includes/user.php does have a check_passwords action but isn't passed $errors to raise weak password errors itself; you'd have to remember the error and add it in user_profile_update_errors later.
- Helpfully there's a check_passwords action there for you to use, but
- Unhelpfully it isn't passed a reference to $errors so the only way you can generate an error for a weak password is to also hook user_profile_update_errors a few dozen lines down, remember the password strength error from your check_passwords hook and add it to the array in user_profile_update_errors.
But there isn't anything like that in a default WordPress install.