Your inbox is public at /u/username. Pick a password so only you can read the messages that land there.
3–20 chars · a–z, 0–9, _
Passwords are hashed with scrypt before they reach the database and are never visible, not even to us.