Most password advice boils down to two competing pieces of folk wisdom: "use a random jumble of letters, numbers, and symbols" and "longer is better than complicated." Both are half-right, and understanding why requires looking at how passwords actually get cracked, rather than just trusting a rule someone told you once.
How passwords are actually attacked
In the vast majority of real-world breaches, an attacker isn't sitting at a keyboard guessing your password one attempt at a time — a login form would lock them out or slow them down long before they got anywhere. The real threat is almost always an offline attack: a database of hashed passwords gets stolen, and the attacker runs enormous numbers of guesses against those hashes on their own hardware, completely outside the reach of any rate-limiting the original site had in place.
This distinction matters because it changes what actually makes a password hard to crack. Against an offline attack, what matters is the total number of possible combinations a password could represent — its "entropy" — because the attacker is going to try combinations as fast as their hardware allows, potentially billions per second on modern equipment for a weakly-hashed password.
Why length beats complexity, mathematically
Here's the part that surprises people: adding one more character to a password multiplies the total number of possible combinations by roughly the size of your character set, while adding a symbol to an already-short password only multiplies it by a smaller factor for that one position. A password that's a few characters longer, even if it's just lowercase letters, can have more total possible combinations than a much shorter password stuffed with symbols and numbers.
This is the entire logic behind the "diceware" or passphrase approach — stringing together several random, unrelated words. Four random words chosen from a large word list can represent more possible combinations than a shorter eight-character password using the full keyboard, while being dramatically easier for an actual human being to remember and type correctly. "correct horse battery staple" (the famous xkcd example) isn't a joke — it's a mathematically sound approach.
So why do sites still demand symbols and numbers?
Because many password policies were written years before this became well understood, and because a policy requiring "at least one number, one symbol, one uppercase letter" is easy to check with a simple regex, whereas checking genuine entropy is harder to communicate to a user in a form validation message. The unfortunate side effect of these rules is that they push people toward predictable patterns — capitalizing the first letter, adding "!" at the end, swapping "a" for "@" — which attackers have long since learned to check for first, meaning the complexity requirement often adds far less real protection than its inconvenience would suggest.
The single most important factor: uniqueness
Length and randomness matter, but neither of them protects you from the most common real-world failure: reusing the same password across multiple sites. When any one site you use gets breached — and a huge number of sites eventually do — attackers immediately try that same email-and-password combination against every other major site, a technique called credential stuffing. It's automated, cheap, and devastatingly effective, because so many people reuse passwords.
This is really the strongest argument for a password manager over any manual memorization scheme, no matter how clever. A password manager lets you use a long, completely random, unique password for every single account, because you never have to remember any of them individually — you only need to remember one master password (ideally a long passphrase) to unlock the manager itself.
A practical hierarchy, from best to acceptable
If you're deciding how to actually handle this for yourself, roughly in order of what protects you best: a password manager generating a long random string for every account is the strongest approach, since you never need to remember or reuse anything. A unique passphrase of four or more random unrelated words per important account is a strong fallback if you're not ready to adopt a manager, especially for a master password you do need to type from memory. A short password with substituted symbols, reused across several sites, is the weakest common pattern and the one most exposed to credential stuffing regardless of how "complex" it looks.
Testing what you've got
If you want to sanity-check an existing password's general strength, our password strength checker evaluates length and character variety locally in your browser — nothing you type there is ever transmitted anywhere. If you're starting fresh, our mixed password generator and passphrase generator both take the "long and random beats short and complex" principle seriously, generating options that are genuinely difficult to guess without being impossible to type when you need to.
The takeaway
Length matters more than symbol-stuffing, uniqueness matters more than either, and a password manager solves both problems at once far more reliably than any manual system you could maintain yourself. If you take away one thing from all of this, let it be: stop reusing passwords, even "strong" ones, across more than one account that matters to you.