It takes a minute. You can add a passkey or an authenticator app afterwards.
At least 12 characters. A short sentence works well.