Passwords must be at least 8 characters and no more than 72 characters. There's no other complexity rule enforced, no forced uppercase letter, number, or symbol.
Why so few rules
Length matters far more than character variety for real-world password strength, forced substitutions (like turning "a" into "@") mostly make passwords harder for people to remember without meaningfully harder for software to guess. A longer, genuinely random or unique password beats a short one with a forced symbol every time.
Tip: Use a password manager to generate and store a unique, random password for your account rather than reusing one from another site — if any other site you use is ever breached, a reused password becomes an immediate risk to this account too.