Every site demands a capital, a number, and a symbol, so I assumed that's what makes a password strong.
Accepted answer
Because length grows the search space **exponentially**, while adding character types only grows the base.
Guesses needed ≈ `(characters available)^(length)`. Going from 8 to 16 characters squares the work an attacker faces. Adding symbols to an 8-character password multiplies it by a much smaller factor — and people satisfy those rules predictably (`Password1!`), so real-world gain is smaller still.
Four or five random unrelated words beat `P@ssw0rd` badly and are far easier to remember. The catch is *random*: a quotation or song lyric is in every wordlist.
Worth knowing for the bigger picture: **reuse** beats complexity as a risk. One breached site hands attackers a password they'll try everywhere (credential stuffing), no matter how complex it was. A password manager plus multi-factor authentication does more than any composition rule.