Length is not the sole measure. Consider password complexity too.
If you use a relatively short password that is fairly random and contains "special" (not alphanumeric) characters, a brute force attack will take ages because the password won't be found in dictionaries. The only way to crack it is to try all combinations in the largest range of characters - not just a-z or 0-9.
But using special characters is not good enough, for example P@ssword is not a good password because plenty of people use it, therefore it is present in cracking dictionaries. A long password will do not good if it is present in dictionaries. I have had a look at some dictionaries on my hard drive and there are many "long" passwords like administrator123 listed (16 characters).
On the other hand a passphrase long enough could offset the lack of complexity while being more memorable. Although I too am convinced that using a password manager is the best solution.
It depends on other parameters too. Say you have somebody's password hash and you want to reverse the password. Relevant factors are: how was the password hashed (and salted), whereas an old hash like unsalted MD5 would make the hacker's job probably easier. It's not just the password but how it is stored and processed in your system.