18 is probably ok, longer than that you start running to shitty sites (like banks) that truncate or reject long passwords.