This thread unfortunately contains a lot of misinformation and bad advice. We recommend not following any of the previous advice given in this thread and there are numerous inaccurate claims made here. This thread is not a good source of information about this topic.
Please read https://grapheneos.org/faq#encryption for a high level explanation of how disk encryption is implemented. Our recommendation is to choose whether or not you want to rely on the secure element throttling (Weaver) and then proceed based on your decision. Since each user profile has separate encryption keys based on their lock method, you can make different choices for different user profiles. Random 6 digit PIN is a baseline where you depend entirely on Weaver for security. Random passphrase can have enough entropy to be secure even without the hardware features. It should have at least around 90 bit entropy to be secure against any attacker. 128 bits is the standard extreme overkill value and is the upper bound on what's reasonable to use.
Please bear in mind that the passphrase is turned into a key via scrypt key derivation and then further key derivation is done with other inputs including the random Weaver token. The final phase is hardware-bound key derivation. If an attacker can exploit the secure element (exploiting the bootloader does not help), they can bypass the Weaver throttling. If an attacker can extract the key from the SoC, they can perform the final key derivation on a server farm instead of only on the device. They still need to run the key derivation algorithms. Your passphrase is not used as a key but rather is the most important input for deriving the key encryption key used to encrypt a random disk encryption key.
7 random diceware words or 18 random lowercase letters / numbers are both slightly above 90 bit entropy. If you want to completely avoid depending on hardware, that's the baseline for what you should use. You don't need 128 bits of entropy for a random passphrase to be secure against any attacker, but you may want more than 90 bits. 128 bits is an extreme overkill value used to design encryption algorithms. Part of the reason for using an extreme overkill value is in case there are partial breaks of the algorithms reducing their security, which is not relevant to a random passphrase used as input for key derivation.
Our official advice will be added to the website and in the future people should link to that.