How long and complex does a password actually need to be?

Length matters more than complexity for resisting modern cracking attempts — a random 16+ character passphrase of three or four unrelated words is stronger and easier to remember than "P@ssw0rd1!". Avoid predictable patterns like a capital letter at the start and a number or symbol at the end, since attackers' tools already expect that.

Coach's tip: let your password manager generate it — you don't need to remember most passwords at all, only the one that unlocks the manager.