Password strength is primarily determined by length and unpredictability. Length is the most impactful factor — each additional character multiplies the number of possible combinations exponentially. A random 20-character password is astronomically harder to crack than a clever 8-character one. Unpredictability means avoiding dictionary words, names, dates, and common substitutions that crackers test first. The strongest practical passwords are either: long random strings (generated by a password manager), or multi-word passphrases of 4+ random words (not a phrase you know — truly random words like "lamp-orbit-cheese-river").

Yes — strongly recommended. Password managers (1Password, Bitwarden, Dashlane, LastPass) generate and store strong unique passwords for every site, requiring you to remember only one master password. The security benefits are substantial: unique passwords per site (so one breach doesn't compromise everything), passwords that are genuinely random (not patterns your brain creates), and no password reuse. Bitwarden is open-source and free. The risk of "all passwords in one place" is mitigated by encryption, which means even if the password manager is breached, the stored passwords are protected by your master password.

Brute force cracking attacks test every possible combination. An 8-character password using all printable characters has about 6.7 trillion combinations. A 12-character password using only lowercase letters has about 95 trillion combinations — already 14× harder despite less "complexity". Length adds combinations exponentially: each additional character multiplies combinations by the character set size (26 for lowercase, 95 for all printable). Complexity rules (mixed case, numbers, symbols) are often counterproductive — they lead to predictable patterns like Password1! while providing less security than simply making the password 4 characters longer.

A passphrase is a password made of multiple random words: "lamp-orbit-cheese-river" or "purple-mountain-coffee-rain". Passphrases are both more memorable and more secure than typical complex passwords. With 4 random words from a 2,048-word list, there are 2,048^4 = 17.6 trillion possible combinations — equivalent to a random 11-character password but far easier to remember. With 6 random words, the combinations become practically impossible to brute-force. The key is that the words must be random (not a phrase or sentence you know) — a random word generator or diceware method ensures genuine randomness.