What actually makes a password strong

Length matters more than complexity rules. A long, random passphrase is both stronger and easier to remember than a short password full of substituted symbols.

What weakens a password

Reuse is the single biggest problem. If the same password is used on multiple sites, one breach anywhere exposes every account using it, a technique called credential stuffing, where attackers automatically try leaked username and password pairs against other services.

Predictable patterns are the second biggest problem: a base word with a number and symbol tacked on, or a password based on public information like a pet's name or birth year, is far weaker than it feels.

What actually helps

A unique, long password for every account, generated and stored by a password manager, is the realistic solution. Nobody can memorise 50 unique strong passwords, and nobody should have to.