Tukuk-OSAttackers do not guess one password; they try billions. When a site is breached, its stolen list is run automatically against every other site you use — credential stuffing — which makes reuse the single deadliest habit, far ahead of “password123” itself. A long random phrase (four unrelated words) beats a short complex one because guessing scales with length exponentially: the character-class tricks humans invent (capital Q, exclamation at the end) are the first patterns every cracking tool tries. A password manager fixes the physics: one strong memorised master key, unique 16+ character random passwords everywhere else, autofill so you never type — and never have to reuse.
Second factors plug the leak: if your password escapes, 2FA means the attacker still cannot log in without a device only you hold. App-generated or push codes (time-based one-time codes, cryptographic approvals) are strong; SMS codes are better than nothing but interceptable via the telecom tricks of SIM-swapping. The newest tier is the passkey: a cryptographic keypair generated and held inside your device or its secure element, where the private half literally cannot be extracted or transmitted. Login becomes a signature challenge bound to the exact site, so even a perfect phishing page cannot make the device sign its requests — passkeys are the first defence that fixes phishing at the math level, and this site supports them.
The ordering to remember: uniqueness first (manager), strength second (random), 2FA third (app or passkey), and for high-value accounts the passkey replaces the password rather than joining it. Recovery codes printed and stored offline are the boring final step everyone skips until they need them.