What makes a password strong (it isn't the symbols)

Decades of password rules trained people to turn password into P@ssw0rd! and feel safer. Attackers know those substitutions perfectly well. What actually resists guessing is the number of possibilities an attacker must work through, and length raises that faster than anything else.

Entropy, in one paragraph

Entropy measures how many possible passwords your generation method could have produced, expressed in bits: each extra bit doubles the work. A random 12-character password from a 94-character alphabet carries about 79 bits — roughly 10^23 possibilities.

The crucial word is random. Entropy describes the process, not the string. A password you invented has far less entropy than its length suggests, because human choices cluster hard around familiar patterns, and cracking tools model those patterns explicitly.

Why length wins

Adding a character multiplies the search space by the alphabet size. Adding a character class merely widens the alphabet a little. Going from 12 to 16 random characters is a far larger gain than adding punctuation to 12.

This is why the old complexity rules backfired. Forcing a symbol and a digit into a short password produced predictable results — a capital at the front, a digit and a bang at the end — while making passwords annoying enough that people reused them.

Reuse is the real risk

Most accounts are not lost to brute force. They are lost because a password was reused, one unrelated site was breached, and the same pair was tried everywhere else. A strong password used in two places is weaker than two mediocre ones.

Which makes a password manager the actual answer: it removes the reason to reuse. Generate a long random password per site, let the manager remember it, and turn on two-factor authentication where it is offered.