Your co-worker is right. You're not using a password. You're using a passphrase. And, there is some humor to this notion.
As famously pointed out by XKCD.com/936: Password Strength (copied and visible in Abhijit's answer, although missing the hovertext like most blatant copies of XKCD graphics do), there are a lot of misperceptions about what makes for good security credentials. In many, many cases, a much stronger method would be to use a cryptographic key which may be hundreds or thousands of bits long. That would be ridiculously challenging to type (I've never actually typed one out myself), but techniques such as effective use of ssh-agent can make such strong security easy to implement on a day to day basis.
The problems with such technology are issues like user education and perhaps compatibility with some software solutions, both of which we can hope to eradicate. Oh, and unfamiliarity by people who select security methods. Education may be able to eliminate all of those problems. I look forward to the day.
Until we achieve such simplicity (of day-to-day usage), the use of passwords is sort of a compromise. Until we can get into a better situation, a much better approach is to limit where passwords are typed so that they are just used in secure scenarios, and then use secured and trusted computer to send more elaborate credentials which are even harder to re-produce manually. But manually going through a lot of effort to achieve better-than-lousy, but worse-than-achievable security just feels like a decision that accomplishes the worst of both worlds.
I myself have admired my best friend's knack for using lengthy passphrases. Also, he ends up making typos and needing to re-type them with some amount of regularity. I find this humorous because I myself can have the same issue with passwords of lengths like 8-13, and so when he gets to his fourth or fifth or sixth word, I feel like he's bringing on such troubles to himself very unnecessarily.
Really, if you analyze this from a cost-benefit scenario, what is the great benefit of extending your password length to things like 35-45 characters? Certainly if a person sticks with 15-19 characters, they will achieve the goal of being abnormally long, more secure than most people, and more secure than what most botnets are going to be able to easily crack. Therefore, the extra twenty-plus characters (or, you're saying forty-plus characters for some passwords you've used) beyond a length like 15-19 just end up being pain-inducing complexity without providing significant benefit. That is why the judgement error is a cause of humor. Best case scenario, you're taking extra time out of your day as you type it correctly each time. (Worst case scenario is that you're taking even more time.)
So although I do admire my friend's willingness to take a serious stance on an important issue like security, I do also find his decision to be a bit misguided. These days, I typically try to keep the laughter to myself just out of politeness, but sometimes do tend to comment on it when I see him needing to try a fourth time to get his passphrase right. (And since I can see how many characters he types, it is usually some of the later characters that get to trip him up.)
how do I politely approach my co-worker and ask him to stop spreading around that I have a long password?
You might also want to consider the IPS stack exchange. That site seems to have lots of questions about "How do I communicate a message that I want to communicate, and not experiencing expected negative results when I know that the person won't appreciate hearing what I want to communicate?" Rephrased, the question is, "how do I do what I want to do, and take away another person's right to respond in a way that person is likely to do, just because I don't want that person to respond that way?" It's really an unfair question, and often the correct answer for a Workplace is to not try to control other people, but just do your part in getting along. But since you asked, I'll go over some possible options.
First, realize that your co-worker may be feeling like he is doing you a favor, by ridiculing you until you re-assess your ways and make more sensible decisions. So this might be more than just him trying to take advantage of an easy opportunity to make a joke. Embarrassing a person into desired actions is a technique that can be effective (at least sometimes), and so your co-worker might not be easily dis-swayed. (Note that I'm not saying that the technique is ethical, even if it seems to reach a desired result. I recognize there may be side effects. Your co-worker may not be considering those as much.) His belief that he is doing you some good may empower his decision, even if you don't like his belief, and even if his belief is actually wrong.
You might need to resort to unpleasant techniques like trying to appeal to a higher authority who may impose behavior restrictions so that your co-worker feels that job security is threatened. (That's really not a very nice approach. Of course, you could argue that you being harassed is not a very nice approach.) Doing that might curtail his behavior.
Another option may be to comply with the behavior he is suggesting from you.
Note that there are compelling arguments why some of the approaches in the prior paragraph are so awful that they should not even be considered. (Some would object to empowering him further by letting him win with such a mean-spirited approach. Some would object to disempowering him through such harsh measures as getting management involved.) So I will not take a stance on which approach is most or least right. I'm just saying those are some of the options that are possible. Some approaches might work better or worse for some people, and may be situational-dependent.
Another option may be to respond. Just say, "When someone gets into our systems because of a short password, it likely won't be my fault." You can shorten that over time. This may actually inspire him to fight more/harder, realizing that a reaction was developed. So the short term result may be to worsen the situation, from your perspective. But if you just keep with the same old reaction, then eventually that exchange will likely bore him into deciding to just drop the topic.