I've seen many articles that suggest a minimum password length of 8 characters. For example, the latest update published on Naked Security - https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo...