Password validation in EPP 4.3

Issue

We are looking for details about password restrictions in the "change password" feature of the "user management" portlet.
1.     Is there a maximum password length?  If so, what is it?
2.     Are there any special characters NOT permitted?  If so, what?

Also, is there any way to add our own restrictions to creating passwords, like character length or require certain characters for example?