Most password advice you've absorbed by osmosis — mix upper and lowercase, throw in a number, add a symbol — is outdated. It made passwords harder to type, not necessarily harder to crack. Here's what actually matters.
Length beats complexity
A 16-character passphrase like correct-horse-battery variants is dramatically harder to brute-force than an 8-character password with every character class crammed in, because the total number of possible combinations grows exponentially with length, not with character-set complexity. If you only change one habit, make it length.
Reuse is the real risk
The password itself matters less than whether it's unique. When one service gets breached — and breaches happen constantly, even to companies with good security teams — attackers try that same email/password pair everywhere else. A merely "okay" password used nowhere else is safer than a "strong" password reused on five accounts.
Check before you commit to one
Run any password you're considering through a Password Strength Checker before you save it. A good checker isn't just counting character types — it's looking at patterns, dictionary words, and predictable substitutions (p@ssw0rd is not clever; every cracking tool checks for it first).
Or skip the guessing entirely
The simplest fix is to stop inventing passwords yourself. A Password Generator produces a genuinely random string with the length and character set you choose, which you then save in a password manager rather than memorize. You only need to actually remember one password ever again: the one to your password manager.
The realistic baseline
- 16+ characters, generated randomly (not a modified word)
- Never reused across more than one account
- Stored in a password manager, not a sticky note or a text file
- Two-factor authentication turned on anywhere it's offered, so a leaked password alone isn't enough
None of this requires memorizing forty passwords or changing them every 90 days — that old advice mostly just trained people to increment a number at the end. Length, uniqueness, and a manager get you further than any amount of forced complexity.