People obsess over password "complexity" — throwing in random capitals and a symbol or two — while ignoring the factors that actually determine security. Here are the four that matter, ranked by real-world impact, not folklore.
1. Length (the biggest factor by far)
Every additional character multiplies the total number of possible passwords by the size of your character set. Going from 8 to 16 characters doesn't double your security — it raises it to a power. A 16-character password is roughly a trillion-trillion times harder to brute-force than an 8-character one, even using the exact same character types.
This is why security experts increasingly emphasize length over complexity. correcthorsebatterystaple (no symbols, all lowercase, 25 characters) is harder to crack than P@ss1! (6 characters, every type) by an enormous margin.
2. True randomness (not human-invented "cleverness")
Humans are bad at generating randomness. When asked to invent a "random" password, people unconsciously favor patterns: capital letter first, a number that's meaningful, a symbol at the end, keyboard-adjacent sequences. Attackers know this and build cracking tools around exactly these patterns — including dictionaries of "leetspeak" substitutions (a→@, e→3, etc.) and common phrase structures.
A password is only as strong as its actual entropy — the number of bits of genuine uncertainty an attacker faces. A password that "looks" random but follows a memorable mental pattern often has far less real entropy than its length suggests. This is the entire reason cryptographic random generators (like the one on this site) exist: they draw from a genuinely unpredictable source, not a human brain.
3. Uniqueness across accounts
A password can be long and perfectly random and still fail completely — if it's reused. As covered in our piece on why unique passwords matter, credential stuffing attacks test known email/password pairs from past breaches against other sites. Strength is irrelevant against this attack; only uniqueness protects you.
4. How and where it's stored (the factor users can't control alone)
The most cryptographically perfect password in the world is worthless if the service stores it carelessly — in plaintext, or hashed with a weak, fast algorithm like unsalted MD5. This is largely outside your control as a user, but you can reduce its impact: avoid services with a history of poor security practices, and — critically — make sure every account has a unique password, so a weak storage practice at one service doesn't expose your password everywhere else.
Putting it together: a genuinely secure password
A genuinely secure password is: long (16+ characters), truly random (generated by a cryptographic tool, not invented), unique (used on exactly one account), and protected by your awareness of where it lives (ideally inside a reputable password manager's encrypted vault, never written in a plain text file or reused across services).
Notice what's absent from this list: arbitrary complexity rules, mandatory symbol placement, or frequent forced rotation. These traditional requirements often push people toward weaker, more predictable passwords (since they're harder to generate "cleverly" by hand) without addressing any of the four factors that actually determine security.