there should be a minimum length.

Or people will use 2-4 character passwords (often the initials of their name etc)