What "Strength" Really Measures
A password is not strong because it feels clever to its owner. It is strong if a computer trying every possible combination would need an enormous amount of time to land on yours. Password strength is essentially a measure of how many guesses an attacker would have to make on average before getting the right one. The harder that work, the stronger the password.
Length Is the Biggest Lever
Adding a single character to a password multiplies the number of possible combinations by the size of the character set. That makes length the single most powerful thing you can do. A four-character password has only so many possibilities, all of which a fast program can race through in moments. A sixteen-character password explodes into a number that is impractical to brute-force even with serious hardware. This is why guidance has shifted in recent years from "use weird symbols" to "make it long" — extra length beats clever substitutions almost every time.
Predictable Patterns Undo Length
Length only helps if the password is not predictable. Attackers do not actually try every possible string at random; they try the most likely ones first. Common words, names, birthdays, sports teams, the word "password" with a one on the end — these are tested first, and they fall in seconds. A long password that is just a familiar phrase from a song lyric is far weaker than the same length of unfamiliar, mixed characters. The goal is to give an attacker no shortcut.
Reuse Is Its Own Risk
Even a strong password has one weakness left: using it in more than one place. Websites are breached regularly, and when that happens, the attackers get the passwords for accounts on the breached site. If you used the same password on your email, they will quietly try it there next. One leak then becomes a chain of break-ins. Using a different password for each important account stops that chain dead.
Where Password Managers Fit In
Remembering long, unique passwords for every site is the hard part of all this for humans. Password managers are programs designed for exactly that job: they generate and store long, random passwords for each account, behind a single strong password that you do remember. That gives you the strength of length and the safety of non-reuse without having to keep dozens of strings in your head.
Source
This article was written using information from Wikipedia.