Tons of useful password validation rules here: http://en.wikipedia.org/wiki/Password_policy

I'd start with minimum length.