At least 8 characters, and not one you use anywhere else. You'll set up an authenticator app in the next step.