be between 8 and 20 characters long
contain at least one number, uppercase letter, or special character