I've read that passwords should be at least twelve characters long. They should contain upper and lower case, digits and special characters. And they must not contain words!