8 to 64 characters, any you like. Very common passwords are refused. Three or four random words make a long password that is easy to remember.