A strong password is long, random, and uses uppercase, lowercase, numbers, and symbols.
Length matters far more than complexity. A 16-character passphrase made of four random words — like "correct-horse-battery-staple" — is stronger than "P@ssw0rd!" because it has vastly more possible combinations, even though it looks simpler.
Attackers crack passwords using two main methods: dictionary attacks (trying thousands of known words and common substitutions like "@" for "a") and brute force (trying every possible combination). Long random passwords resist both because the search space becomes impossibly large.
Weak passwords share predictable patterns: real dictionary words, keyboard walks like "qwerty" or "12345", personal information like birthdays or pet names, and common substitutions like "3" for "e". Attackers build dictionaries specifically from these patterns.
The safest approach: use a password manager to generate and store truly random passwords. You only need to remember one strong master password. Every other account gets a unique, generated password that no human — including you — needs to memorize.