Make short links and QR codes, and count every click.
At least 12 characters, with upper and lower case letters, a number and a symbol. It can't be a password that has leaked online.