20 characters is fine. Even using only lowercase letters, in a worst-case scenario it'll take millions of years to guess by choosing characters, and a dictionar

20 characters is fine. Even using only lowercase letters, in a worst-case scenario it'll take millions of years to guess by choosing characters, and a dictionary attack won't fare any better if you use four words that are moderately rare. Even if they're only in the top 1000, four words means the search space is 1 trillion guesses. Increase the search space to 10,000, by including such obscure words as "villager" and "conserve" and "missionary" (9950, 9973, and 9991, respectively) the search space increases to the quadrillions, equivalent of a 12-character random password with symbols, 53 bits. Is correct-horse-battery-staple guaranteed secure to the heat death of the universe? No, but good enough that it'll take a targeted attack several months to guess.