The password for a regular CU*BASE employee ID (remember this is the 2-character ID that controls access to individual tools from the home page, not the username you use to log in to CU*BASE in the first place) can be anywhere from 2-8 characters in length and can contain letters and numbers. The minimum length can be controlled by your credit union via Tool #327 CU*BASE Employee Security (click the CU Options button).
That same CU Options feature also lets you control whether or not the employee ID password expires regularly. You can set set any period from 1 to 998 days, or use 999 for non-expiring passwords.
NOTE: The requirements for a data center employee ID password, used by data center employees and by operations teams at our self processing credit unions, are a little different and are not currently configurable. Passwords for data center employee IDs must be between 4-8 characters long, and expire automatically every 30 days (based on the date the password was last changed). Employees will be warned about an expiring password 7 days prior to it expiring, and expired passwords can be changed by the employee via Tool #40 Change Employee ID Password (or OPER Tool #5431 Change Employee ID Password).