"Use a strong password" is the most repeated and least explained advice in computing. Most people respond by doing what feels strong: capitalise a word, swap a letter for a symbol, append a year and an exclamation mark. The result feels complex and is, to an attacker, nearly worthless. Strength is not a vibe. It is three measurable properties — unpredictability, length and uniqueness — and once you see them, you cannot unsee why human-invented passwords fail.
Attackers guess patterns, not characters
Nobody cracks passwords by trying aaaa, aaab, aaac. Real attacks begin with billions of passwords leaked from earlier breaches, then apply the transformations humans reliably make, in the order humans reliably make them: capitalise the first letter, swap a for @ and o for 0, append the year, append a "!". A password like Dragon2024! is not a needle in a haystack; it is one of the first few million guesses a cracking rig makes.
The measure that cuts through the folklore is entropy: how many equally likely possibilities the password was chosen from, expressed in bits. A character drawn truly at random from a 94-character set adds about 6.5 bits, so length compounds quickly — twelve random characters are roughly 79 bits, sixteen roughly 105. Each extra bit doubles the attacker's workload, which is why one more character beats any amount of clever symbol-swapping.
Length first — but randomness above all
Given the choice, take length. A long passphrase of several unrelated words is both stronger and easier to live with than a short knot of symbols — provided the words are chosen by dice or software. Human "random" choices cluster heavily on the same few thousand favourite words, in predictable orders, and attackers' dictionaries encode exactly those habits.
That caveat is the real argument for generating passwords with software rather than inventing them. Generated output looks ugly because it carries no pattern, and carrying no pattern is precisely the point. The entropy figures only hold when the choice is genuinely random; the moment a person picks the characters, the effective strength collapses to whatever the breach dictionaries already know about people.
The rule everyone breaks: uniqueness
Even a genuinely strong password turns into a liability when it is reused. Breaches are routine, and the first thing done with a freshly leaked email-and-password pair is to try it — automatically, within hours — against banks, email providers and social networks. This is credential stuffing, and it works because reuse is so widespread. One unique password per account confines any single breach to a single account.
Nobody can memorise a hundred unique random passwords, and nobody is meant to. That is the password manager's job. Remember one long passphrase — for the manager itself. Turn on two-factor authentication for your email and banking, the accounts that can reset all the others. Then let software generate and store everything else.
A three-question self-check
Take any password you rely on today. Could a stranger who knows your name, your pets and your team guess its ingredients? Has it — or a close cousin with a different year — ever been used on another site? Was it invented by a person rather than drawn at random by software? A "yes" to any of the three means that account is protected mainly by luck. And luck is the one factor that deteriorates every year, as breach databases only ever grow.
Try the tool behind this article: Password Generator runs entirely in your browser — nothing you paste is uploaded.