It should be at least 8 to 12 characters long. The longer the character string is, the harder it is for a brute-force attack to crack it.