At least 12 characters. Four or five unrelated words beat a short complex string — they are easier to remember and much harder to attack. This password cannot be reset. It is the only thing that opens your vaults.