3 to 50 characters, letters and numbers only, and cannot begin with a number.
Used for account recovery and security notices only. Stored encrypted, never shared.