At least 12 characters. Length matters more than symbols — a memorable passphrase beats a short complex one.