I'm sure you will get better answers than this one that detail the exact maths.
A password can be as long as you want it to be (within the rules of the system). The longer it is, the more it will slow down someone who is trying to bruteforce it. Making it more complex by adding special characters, numbers upper and lower case letters will slow them down even more.
Bruteforcing passwords costs money, so really you just want to make it so it is not worth the cost of bruteforcing your password. That worth will be determined by what you are using it for.
You can check the strength of any possible passwords you may want to use at www.passwordmeter.com
As a rule of thumb, I would suggest at least 7 to 9 characters with some special characters, numbers and upper and lower case characters. This is just my opinion though and not hard and fast rules.
One mistake I often see is passwords that are so complex either because the password policy forces it or because the user just wants it, that people can't remember their passwords, so they end up making an insecure copy of it, i.e writing it down on sticky note. Writing it down undermines the whole purpose of have having a really complex password in the first place.
So password length and complexity is also a compromise between accessibly, ease of use and security.