Six digits. Not all the same digit, and not a run like 123456.
At least 12 characters. No required capitals, digits or symbols — length is what matters. A passphrase of a few words is easier to remember and harder to guess than something short and cryptic.