NIST's 2017 guidelines say:

5.1.1.2: "Verifiers SHALL require subscriber-chosen memorized secrets to be at least 8 characters in length. Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length." [1]

[1] https://pages.nist.gov/800-63-3/sp800-63b.html or https://doi.org/10.6028/NIST.SP.800-63b