12 character random strings are an absolute minimum for a secure password, because brute forcing and tabling start to become impractical. Longer strings are even better.

I wouldn't consider an 8 char password secure, no matter what the entropy is.