Add rules for what counts as a passphrase to readme or documentation

[TetraK1]

It's currently not obvious when something will or won't count as a passphrase - it would be nice to know the exact rules that are used to decide whether a string is a passphrase without code-diving.