I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of how WiFi passwords need to be long.
The "strength" of the VPN is twofold. You want two things:
If the VPN is any good, then you password impacts only the second type of strength, and the only attack vector for the attackers is an online dictionary attack. "Dictionary attack" means trying potential passwords. "Online" means that the attacker must contact the VPN server for each password he wants to try.
Preventing offline dictionary attacks is very important, because with an offline dictionary attack, the attacker tests passwords on his own machines (e.g. he could obtain a hash of the password), and therefore can speed up the attack by throwing more machines at it. With an online dictionary attack, the attack will be no faster than what the VPN server is willing to accept.
Suppose that the VPN server can "try" 1000 passwords per second; this would be typical of a rather strong PC and a VPN with SSL (SSL connection between client and server, then client shows his password within the tunnel -- there again, the server can botch it by allowing too eagerly SSL session reuse). If the space of potential passwords has size one billion, then, on average, the attacker will have to try 500 millions password before hitting the right one. At 1000 per second, this will take him about 6 days.
This highlights the important points:
Whatever is the method by which you generate passwords, you must assume that the attacker knows it (he is evil, after all). The best passwords are generated randomly, with real randomness, i.e. your computer, not your head. If you generate a 10-character password where all characters are digits or letters (lowercase and uppercase), and each character is really chosen at random and independently of the others, then there are 6210 = 839299365868340224 possible passwords; that's the size of the set. And if you use randomness, then the attacker has no other choice than to try them all; at 1000 passwords per second, attack will take him, on average, more than one million years. I daresay that it is sufficient.
So use your best dice, generate ten random characters, and that will be fine. If it is not fine, then the VPN implementation is doing something stupid, and you would be well advised to look for a better VPN. The important points for password generation are:
There are many different types of VPN technology, so the answer isn't a static one. Often passwords are hashed or use other key-strengthening technology so that short passwords don't create insecure connections (except, of course, for the fact that short passwords are easier to guess).
A 10-character password is a 57-bit keyspace if you use mixed case, 47 bits if you use only one case. That's not really good enough for today's technology.
You should really use something like:
All lowercase: At least 16 to 18 letters
Try heading over to http://howsecureismypassword.net/ and pounding away with sample passwords to get an idea of what's good and what's not so good. For most people this is an eye-opening experience.