At least 12 characters. Use a passphrase — a few unrelated words is harder to guess than “P@ssw0rd!”