Most password advice is a tangle of half-remembered rules — a symbol here, a number there, change it every month. Much of it is outdated, and some of it actively makes passwords weaker. The modern understanding is simpler and more effective, and it rests on one idea: unpredictability, spread across every account.
What actually makes a password strong
A password’s strength is really its unpredictability — how many guesses an attacker would need. The technical measure is entropy, and the single biggest lever on it is length. A long password has vastly more possible combinations than a short one, no matter how many symbols the short one contains. This is why a long passphrase of ordinary words can be far stronger than a short string of jumbled characters, while also being easier to remember.
Why length beats complexity
The old habit of taking a short word and dressing it up — swapping a for @, adding a 1 at the end — feels clever but adds little real unpredictability, because attackers know those tricks and try them first. Adding length adds unpredictability much faster. Four or five random words strung together produce an enormous number of possibilities while remaining something a person can actually recall. Complexity rules that force symbols often just push people toward predictable patterns.
The reuse problem
Even a strong password becomes a liability if it is used in more than one place. Breaches happen, and when one service leaks its passwords, attackers immediately try the same combinations everywhere else — a tactic that succeeds precisely because people reuse. The most important habit in password security is therefore uniqueness: a different password for every account, so that a breach of one never becomes a breach of all.
Password managers do the hard part
Unique, long passwords for dozens of accounts are impossible to memorise, which is exactly the job a password manager solves. It generates strong, random passwords, stores them encrypted, and fills them in when needed, so you only remember one strong master passphrase. This resolves the tension between “strong” and “memorable” by not requiring you to remember most of them at all. For the master password itself, a long random passphrase is ideal.
Add a second factor
A password is one thing you know; a second factor is something you have, such as a code from an app or a hardware key. Enabling two-factor authentication means a leaked or guessed password alone is not enough to get in. It is one of the highest-value steps available, especially on important accounts like email, which often acts as the recovery route for everything else.
Sensible habits, and myths to drop
A few habits matter: use unique passphrases, lean on a manager, turn on a second factor, and be wary of entering credentials on pages you reached from an unexpected link. Some old rules can be dropped — forced periodic changes, for instance, tend to push people toward weaker, patterned passwords and are no longer recommended unless there is a sign of compromise. Judge a password by its unpredictability and its uniqueness, not by whether it satisfies a checklist of symbols.