3 ms·

but the real question is why he needed password length constraints instead of password strength constraints...