A tooltip (if you mean in the traditional sense, ie. something shown on hover) does not seem useful as people have no reason to hover over the password field. Placeholder text could be used (currently it's just "Enter a password"), although on mobile web on small screens there is no field label and the placeholder text is used to tell what the field is for; and the space is pretty limited. Or simply put something below the form (the same place where the error will show up, and same design, just a non-error color).

This could either be hand-set or (ideally) generated by from the reqiurements, in which case it would have to be built into $wgPasswordPolicies somehow. Which I think is a good idea anyway, password policies should be able to alter the form. Filed T211514: $wgPasswordPolicy should be able to alter the password form field about that.