While your question ask on how to display password rules, I would instead like to argue why not to enforce any password rules at all, and why they are bad ux. I'm strongly resisting the urge to inline the obvious XKCD comic here, instead concentrating on points already made in the very related question on security.SE, Is it safe to show users why their password is not allowed?, and I'd like quote from both Tom Leek's accepted answer and mine:
[Tom Leek] In any case, "password requirements" are counter-productive and decrease security, save for a "minimum length" which can be rationally justified. So just don't do that. Key to password security is user education, possibly helped with some tools (e.g. a random generator for strong passwords).
[me] I recommend not forcing users to choose an arbitrarily complex password that they will simply end up writing down on a post-it next to their monitor (or having them reset their password as simplified "login"). Instead, let them know that their password is weak, tell them what a good yet memorable password is (e.g. use a pass- phrase instead) and allow them to proceed anyway after clicking a "Yeah, I understood my password is not very secure, let me proceed anyway" - it's their fault if the account gets hacked then and you should not be liable after this explicit warning. Assuming you did use a proper and established password hashing instead of homebrew-crap or, worse, plaintext.
So in summary, instead of displaying some arbitrary password "rules" anywhere, please simply provide a link "How to choose a good passphrase?" (phrase, not word!) and add a "password/phrase strength indicator" next to the field. Allow even something as moronic as "123" or "password" but make it clear that you don't take any responsibility for the user's not using something more secure.
And finally, take care you store the password/phrase securely and never as plaintext! See also here