Ask ten people what makes a good password and you'll often hear that a random jumble of letters, numbers, and symbols is safest — but if you actually watch how real people are told to create passwords versus how memorable, genuinely strong passwords are best constructed, there's a persistent gap between conventional policy and what actually works well for a human being who has to remember and type the thing.
The tradeoff nobody states explicitly
Every password scheme sits somewhere on a spectrum between "hard for a computer to guess" and "easy for a human to remember and type correctly." A truly random 20-character string with mixed case, numbers, and symbols sits at one extreme — excellent for the first property, terrible for the second, to the point that most people simply can't reliably produce it from memory and end up writing it down somewhere insecure, defeating much of the point. A short, memorable word sits at the other extreme — great for the human side, terrible for the security side, since it's exactly the kind of thing an automated guessing attack checks first.
The genuinely useful password schemes don't ignore this tradeoff — they find a specific point on that spectrum that gets meaningfully strong security while staying realistically usable, rather than pretending the tradeoff doesn't exist.
The passphrase approach: length as the primary lever
A multi-word passphrase — several genuinely random, unrelated words strung together — leans hard into the "human can actually remember this" side of the tradeoff while still achieving strong resistance to guessing, because the total number of possible combinations scales enormously with each additional random word, even though every individual word is a normal, pronounceable, memorable word rather than a random character string. Four or five words drawn randomly from a reasonably large word list can represent more total possible combinations than a much shorter fully-random character password, while being dramatically easier to actually recall correctly under pressure — say, typing a master password while someone's waiting for you at a checkout counter.
The key word here is "random." A passphrase built from words you personally associate with each other — a pet's name plus a birth year plus a favorite color — defeats the purpose, because that kind of personally meaningful phrase is exactly the pattern that a targeted guessing attack (as opposed to a purely brute-force one) is specifically designed to try first. The security value of a passphrase comes from the words being genuinely unrelated and randomly selected, not from the phrase merely being long.
The mixed approach: a middle ground
A different middle-ground pattern combines a single memorable random word with a short string of numbers and a symbol — something like a random word plus a three-digit number plus a special character. This doesn't reach the same raw entropy as a full multi-word passphrase, but it satisfies the character-variety requirements that many login forms still enforce (at least one number, one symbol, one letter), while still anchoring around something more memorable than a fully random string. It's a reasonable compromise specifically for situations where a site's password policy requires that character mix and won't accept a pure multi-word passphrase.
Where a password manager changes the calculation entirely
Everything above assumes you actually need to remember the password yourself. If you're using a password manager — which, for the overwhelming majority of your accounts, is genuinely the better approach — the memorability side of the tradeoff disappears almost entirely, because the manager remembers the password for you. In that case, a fully random, maximally long string generated by the manager itself is simply the strongest option with no real downside, since you never need to type or recall it manually.
The passphrase and mixed-word approaches earn their keep specifically for the small number of passwords you genuinely do need to remember and type from memory — most commonly, the master password unlocking your password manager itself, or a device passcode you're entering constantly throughout the day.
Generating either type
Our passphrase generator produces genuinely random multi-word combinations for the cases where memorability matters most, while our mixed password generator covers the word-plus-number-plus-symbol middle ground for sites that specifically require character variety. For anything you don't need to remember at all — which should be most of your accounts if you're using a password manager — a fully random string from a dedicated password generator remains the strongest single option.
The takeaway
There isn't one universally "best" password scheme — the right choice depends on whether you actually need to remember it yourself. For the handful of passwords you do need to recall from memory, a genuinely random multi-word passphrase is usually the strongest realistic option; for everything else, let a password manager generate something you'll never need to type from memory at all.