I had first used 16 characters, but lately I'm thinking that's too much "future-proofing". Base36 already provides a huge pool to draw from for each character slot.
to transliterate all punctuation and case, AKA base36
$ openssl rand -base64 12 | tr '[:punct:]' '[:alnum:]' | tr '[:upper:]' '[:lower:]'
sr6a8iqf719jzxup # 16 characters
$ openssl rand -base64 6 | tr '[:punct:]' '[:alnum:]' | tr '[:upper:]' '[:lower:]'
sr6a8iqf # 8 characters