You will be asked to verify your email before the first sign-in. Firm access arrives with an invitation.
At least 8 characters. Stored as a hash on the API; this app never sees it again.