For a long time, the standard advice was to require uppercase letters, digits, and special characters. The practical result: passwords like `P@ssword1!`, easy for cracking software to guess despite their complex appearance, and a pain for humans to remember.
A 20-character password made up of only lowercase letters is, mathematically, far harder to crack by brute force than an 8-character password stuffed with symbols. The time needed to exhaust every combination grows exponentially with length, not with character variety.
Instead of a password, think in terms of a phrase: string together 4 to 6 unrelated words, for example `flamingo-office-42-fan`. This is:
Add a digit or symbol somewhere in the phrase if the service requires it, but it's no longer the central element of security.
For any account where you don't need to type the password from memory (because a password manager fills it in for you), a random generator is strictly superior to any memorable method: 24 fully random characters, unique per service.
That's the trade-off Encryvault offers: a built-in generator for all your everyday accounts, leaving you with just one password — yours, the one for your vault — to remember, and that one deserves a real passphrase.
A strong password in 2026 is above all a long and unique password. Artificial complexity (mandatory symbols, required uppercase) is secondary — useful if the service requires it, but it's no longer the factor that truly protects you.