At least 12 characters. The code is used up, every device signed in to this account is signed out, and the change is recorded. If you have no codes left, nobody can do this for you remotely.