UTORid passwords must contain between 16 and 128 characters. There is no restriction on the characters you may use in your password. Users are encouraged to use a "passphrase", which is an easy to remember but longer phrase like "Pirates eat lemons under the moon". Please note that when you are choosing your new password it must differ from your old password by more than 3 characters, and you cannot re-use any of your old passwords. Remember not to re-use your UTORid password on other accounts.
Continuing to use a legacy password of 15 characters or less is insecure and may lead to unexpected login issues. Users with a legacy short password are strongly advised to change their password.
Learn about best practices for crafting strong passwords from the university's Information Security department.