At least 10 characters. A reset code is good for a day, works once, and comes from whoever runs this copy of Munnodi — nothing here sends email.