The traditional advice — mix uppercase, lowercase, numbers and symbols — produces passwords that are hard to remember but not actually that hard to crack. Modern password security is simpler and more effective.
Why Short Complex Passwords Fail
"P@ssw0rd!" is a classic example of a password that ticks all the complexity boxes but is trivially guessable because it follows a predictable pattern: dictionary word, letter substitutions, symbol appended. Automated crackers know all these patterns.
The Passphrase Approach
A passphrase is four or more random words strung together: "correct-horse-battery-staple" (a famous example). This is far stronger than a short complex password and much easier to remember. Length beats complexity — a 20-character passphrase with no special characters is stronger than an 8-character password with every symbol type.
The Real Rule: Unique Passwords for Every Site
Using the same password across multiple sites is the most dangerous thing most people do online. When one site is breached (and sites get breached constantly — check haveibeenpwned.com), criminals test those credentials on every other major site. This is called credential stuffing and it's automated and immediate.
The Only Practical Solution: A Password Manager
No human can remember 50+ unique strong passwords. A password manager (Bitwarden is free and excellent; 1Password and Dashlane are paid options) remembers them all. You only need to remember one strong master password. The password manager generates and fills unique 20-character random passwords for every site.
Two-Factor Authentication
Even a perfect password can be stolen through phishing or a database breach. Two-factor authentication (2FA) means a stolen password alone isn't enough — the attacker also needs your phone. Enable 2FA on your email, banking and social media accounts at minimum. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.
Check If You've Been Breached
Visit haveibeenpwned.com and enter your email address. This shows every known breach your account appeared in. If your email appears, change the password for that service immediately, and any other service where you used the same password.