I'm going to differ from the other answers (so far) and suggest that if you're generating a unique random password per website, you don't need a really long password at all.
Lets think about the threats to passwords. We'll look at the server-side alone (i.e. we won't take account of things like keystroke logging malware on your PC as password length doesn't help much there)
So basically attacks, for which password length is relevant, fall into two categories. Online brute-force and offline brute-force.
In online brute-force, the attacker tries to guess your password against the website, so they submit one request per attempt. In reality many sites will lock out after a number of incorrect requests, but for this lets assume they don't
Now assume the attacker can make 1000 guesses per second. If you have (for example) chosen a 8 character random password using Upper, Lower and numeric characters there are 62^8 options. At that rate we're talking heat death of the universe before they guess it.
Now someone could say "what if the attacker gets a botnet to guess it, they can go much faster!", I'd suggest that you'd DoS pretty much any site before you make this fast enough to be practical.
Ok lets talk offline brute-force as it's more relevant to password length. Here the atacker has already got a copy of your password hash, so it's likely they've compromised the security of that site pretty thoroughly. Here you can make an argument that you want the password to last long enough for the site to notice they've been pwned and get you to reset your password.
To say exactly how long is kind of tricky as it very much depends on how the site stores their passwords. If they use unsalted MD5 that's a massive difference than if they're using bcrypt with a high work-factor.
However one thing to consider in all this is impact. What's the impact of this password being cracked. Well if you've used a unique random value for every site, then the impact is likely to be quite limited. you'd hope that your high value sites are all using 2FA so password alone doesn't get the attacker far and the low value sites, well what are the consequences of compromise?
All that analysis doesn't really answer your question, but as a rule of thumb I'd suggest if you're even using 10-12 characters with Upper, Lower and numeric and the passwords are really random (that's the important bit) you're a) likely to be fine and b) unlikely to run into problems with any site restrictions.
Per this article on password cracking a 10-char upper, lower, numeric password would take 83 days for a "Super computer or botnet" to crack. What you've got to ask yourself is, is it likely that an attacker will invest that cost to break a single password where they have already compromised the security of the target site to get the hash....