The quick answer

Length wins. A 16-character random password has vastly more possible combinations than a short password with symbols, and modern password crackers are so fast that complexity alone becomes nearly irrelevant. Given the choice, add characters to the password before adding character classes.

Why complexity stopped scaling

Cracking tools now test billions of hashes per second on modest hardware. An 8-character password mixing upper, lower, digits, and symbols sits in a search space that a determined attacker can exhaust in hours or days. Push the length to 16 and even a mask attack on the full character set becomes computationally unrealistic - the search space grows exponentially with length, while adding a character class only multiplies it by a small constant.

What to aim for

  • 16 characters minimum for anything important; 20+ is comfortable headroom.
  • Random, not memorable-but-guessable. Avoid phrases from songs, quotes, birthdays, and keyboard runs.
  • Never reuse. A credential stolen from one service must not unlock the others.

Passphrases are still fine, with a caveat

Memorable passphrases (four random words) can reach strong entropy, but only when the words are chosen randomly from a large wordlist and the combination is not a known quote. The danger is picking a 'passphrase' that is really a familiar sentence - those are already in cracking dictionaries.

Generating passwords you can trust

Randomness quality is everything. Use a generator backed by a cryptographically secure source, let it choose the full length and character mix, and never weaken the output to 'something I can remember.' Storing it in a password manager removes the temptation to write it on a sticky note or reuse a favorite pattern.

The leftover piece: multi-factor authentication

A strong password is not the last line of defense; it is the first. Add app-based multi-factor authentication wherever it is offered. MFA defeats most attacks that succeed even against a long password, because the attacker would need your second factor, not just your password.