Most people know their passwords are weak. The problem is that the old advice – mix uppercase, lowercase, numbers, and symbols – produces passwords that are hard for humans to remember and easy for computers to crack.

Here is what actually works.

Length beats complexity

A 20-character passphrase made of common words is stronger than an 8-character string of random symbols. The math is simple: every additional character multiplies the number of possible combinations.