Used for the confirmation link and password resets. Nothing else.
At least 12 characters. Length beats punctuation — a short phrase you can remember is stronger than one substituted word.