Short passwords are easily brute-forced." The longer the better - and mixing it up doesn't hurt, either So what's a user, or ...