The minimum requirements are that it passes the zxcvbn library’s strength check. I can’t see a simple summary of their rules. This is registered as script ‘zxcvbn-async’ that you can enqueue / make a dependency of your own scripts, and then you can run the check yourself on the client-side. See password-strength-meter and user-profile.js‘s multiple cases for zxcvbn being not-yet-loaded.
Nowadays WordPress encourages you to use randomly generated passwords
- new user registrations always have a randomly generated password
- to change your password in the admin site you click ‘generate password’ to get a new random one; it does give you the chance to override it but will disable the ‘Update profile’ button on the page until your password has passed a zxcvbn check.
This is only enforced on the client-side though; there’s no server-side enforcement as far as I can see. user.php does have a check_passwords action but isn’t passed $errors to raise weak password errors itself; you’d have to remember the error and add it in user_profile_update_errors later. But there isn’t anything like that in a default WordPress install.