How do I choose a password that is actually strong?

A password is a number an attacker has to guess. Everything about choosing one follows from asking how many guesses it costs, and almost every habit people have been taught optimizes for the wrong thing.

The one number that matters#

Every position you add multiplies the work. Every character you pick from a bigger alphabet multiplies it too, but only by a little, and the two are not equal partners. Adding one word to a passphrase buys about thirteen bits. Adding a symbol to the end of a word buys almost nothing, because the attacker knows that is where you put it.

Where the randomness has to come from#

Those numbers assume every word was picked at random. Choose the words yourself and they collapse, because you will pick words that go together, and an attacker guesses phrases before they guess noise. "correct horse battery staple" is a famous example and a bad password, for the same reason.

Why the rules you were taught backfire#

"One uppercase, one number, one symbol" was a reasonable guess in 1985 and has been measured since. What it produces is a capital at the front, a digit at the end, and an exclamation mark after that. The pattern is so consistent that cracking tools encode it as a rule and try it first. The rule narrows the search space it was meant to widen.

What happens to it here#

Your password is never stored. What is stored is a bcrypt hash at cost factor 12, which means the hash is deliberately slow to compute: about a third of a second on a modern laptop. That slowness is the point. It is a per-guess tax an attacker pays on every attempt against a leaked hash file, and it is the reason length buys you as much as it does.