May only contain letters and numbers.
Must be at least 5 characters long.
Needed to retrieve lost passwords.