At least 8 characters. We also check new passwords against known data breaches, so a password you have reused elsewhere may be rejected.