12+ characters. We'll check against known leaked-password lists.

If a friend invited you. Already-applied referrals from a shared link are honored automatically — you don't need to retype.