What makes a strong password in 2026?
The short answer
Long beats complicated. A passphrase of four or more random words (like "bike-cloud-lemon-plug") is stronger and easier to remember than a short jumble of characters. For everything except your master password, let your password manager generate them. Those come out unique and strong, automatically.
In detail
The old rules (at least one capital, digit, and symbol) produced predictable passwords. Welcome2024! ticks every box and cracks in seconds. Modern guidance, including from standards bodies like NIST, centers on length instead. Every extra character multiplies the possibilities. A phrase of four random words gives you dozens of characters you can still remember.
In practice you only need to know one or two passwords yourself. The master password of your manager, and perhaps your computer login. Make those word phrases. Everything else is generated by your password manager, at twenty random characters per service, never reused, filled in automatically.
Just as important as strength is uniqueness. A strong password used on ten sites is worthless on all ten after one leak. Unique-and-reasonably-strong beats ironclad-but-reused, and uniqueness is exactly what the manager automates for you.