Use 8 to 64 characters. Spaces and any characters are allowed, so a phrase of a few words works well. Accented letters and emoji take more room, so a password made mostly of them must be shorter. Passwords found in known data breaches are refused.