Every extra character multiplies the search space. Going from 12 to 20 characters helps far more than adding symbols to a short password.
Tip: a password manager plus one unique random password per site beats one clever password that is reused everywhere.
Strength is a measure of how much guessing an attacker has to do, and guessing is measured in bits: every bit doubles the work. What produces those bits is the size of the pool a character was drawn from, multiplied by how many characters there are. Everything else people believe about passwords — complexity rules, forced rotation, special-character quotas — is a weak proxy for those two numbers.
| Length | Pool | Approximate combinations |
|---|---|---|
| 8 | Lowercase only (26) | 2 × 1011 |
| 12 | Lowercase and digits (36) | 5 × 1018 |
| 16 | All four sets (85) | 7 × 1030 |
| 20 | All four sets (85) | 4 × 1038 |
Read that table as an attacker would. An eight-character lowercase password falls to a single modern graphics card in minutes. A twenty-character password from the full pool is not reachable by any brute-force approach that is currently practical, regardless of how fast the hardware becomes in the next decade.
Substituting letters for numbers — p@ssw0rd — adds almost nothing, because the substitutions are the first thing every cracking tool tries; the patterns are in the dictionaries. A passphrase of four unrelated words does have real entropy, and it is a defensible choice where typing is unavoidable. But for anything a password manager can hold, a long random string is strictly better.