At least 12 characters. Longer passphrases are stronger — avoid passwords you've used on other sites.