At least 12 characters. Setting it also confirms your email address, and signs you out anywhere else you are signed in.