Longer passwords resist brute force better than complex short ones. Include upper, lower, digits, and symbols when the site allows; avoid predictable patterns.

Never reuse passwords across accounts; rotate after breaches when recommended.