"Use a mix of uppercase, lowercase, numbers, and symbols" is the advice most sites still show at signup, and it's not wrong — it's just not the part that matters most. Length does more to make a password hard to crack than complexity does, and reuse does more to make an account vulnerable than either.
Why length wins
Password strength against brute-force guessing comes down to how many possible combinations an attacker has to try. Adding characters grows that number exponentially; swapping a letter for a symbol barely moves it. A 16-character password of random lowercase letters is harder to brute-force than an 8-character password stuffed with symbols, simply because there are vastly more 16-character combinations to search through.
The bigger risk is reuse, not weakness
Most account takeovers don't come from someone guessing a password character by character — they come from a password reused across sites getting exposed in an unrelated breach, then tried against every other account with that same email. A password manager that generates and stores a unique password per site removes that risk entirely, regardless of how "strong" any individual password is.
Generating one that isn't a common pattern
- Open the Password Generator and set a length of at least 16 characters.
- Enable uppercase, numbers, and symbols if the site requires them — it doesn't hurt, it just isn't the main lever.
- Generate a new one per account rather than reusing a variation of an old password.
What to avoid regardless of length
Dictionary words, keyboard patterns (qwerty, 123456), and personal details (birthdays, pet names) are the first things automated cracking tools try, no matter how long they are. A randomly generated string sidesteps that category of attack completely — the trade-off is that you need somewhere to store it, which is exactly what a password manager is for.