How to Create a Strong Password You Can Actually Remember

Most password advice fails for a simple reason: it tells you to create something impossible to remember, so you end up reusing one password everywhere or writing it on a sticky note. There is a better method. A long passphrase made of ordinary words is both harder for computers to crack and easier for you to remember than a short jumble of symbols. Here is how to do it properly.

The problem is not that people are careless. It is that the old advice — a short password with a capital, a number, and a symbol, changed every month — produced passwords that were hard for humans and easy for software. Attackers do not sit guessing by hand; they run lists of common passwords, names, dates, and patterns. A password that looks clever to a person, like a word with a number on the end, is often one of the first patterns a program tries.

Why length beats complexity

Password-cracking software tries combinations. Every character you add multiplies the work enormously. A short password like "Tr0pic!9" looks clever, but it is only 8 characters — a computer can chew through short passwords far faster than people expect. A passphrase of four ordinary words — say, twenty or more characters in total — is a vastly larger search space, even though it looks simple. That is the whole trick: length is the strongest ingredient, and words give you length you can actually hold in your head.

The famous illustration of this idea uses four random common words joined together. It works because the words are random, not a phrase anyone would guess. "Correct horse battery staple" is the classic example — do not use that one, since it is now famous enough to be on every guessing list. Make your own.

It is worth understanding why randomness matters as much as length. A long phrase from a song lyric or a famous quote is long, but it is also on a list somewhere. A sentence about your own life — your street, your team, your child's name — is long, but it is guessable by someone who knows you or who can look you up. Four words with no connection to each other, chosen at random, are long and unpredictable at the same time. That combination is what makes a passphrase strong.

The passphrase method, step by step

Step 1: Pick four genuinely random words. Open a book at random, look around the room, or use a word generator — but do not pick a sentence that means something ("ilovemydogmax" is not random; a pet's name is one of the first things an attacker tries). The words should have no connection to each other. As an illustration only, something shaped like "purple tiger dances quickly" shows the pattern — four unrelated words, easy to picture, hard to guess.

Step 2: Add one number and one symbol, somewhere in the middle. Many sites require a number and a symbol, so build them in from the start rather than bolting them on at the end. For example, take your four words and put a number after the second word and a symbol after the third: "purple tiger 42 dances! quickly". The exact placement does not matter; what matters is that it is not the predictable pattern of one capital at the start and "!" at the end, which guessing software tries first.

Step 3: Capitalise one word, not the first one. Again, avoid the predictable pattern. Capitalising the second or third word ("purple TIGER 42 dances! quickly") adds strength without making it harder to remember.

Step 4: Say it as a picture. The reason this works is that you remember an image, not a string. "Purple tiger dances quickly" is a mental picture. If your words do not form any image at all, swap one until they do. A passphrase you can visualise is one you will still remember in a month.

Step 5: Test it honestly. Type it three times from memory, with a gap in between. If you fumble, change one word rather than writing the whole thing down somewhere risky. A password you cannot type reliably is a password you will reset constantly — and every reset is a chance to fall back to something weak.

Do not use the example above as your own passphrase, and do not just change one word in it. Examples in guides like this one are exactly the phrases that end up on guessing lists. Use the method to build your own, from words you chose randomly, and keep it private. If you need inspiration, flip through a dictionary or a cookbook at random pages and take the first ordinary noun you see on each page — that randomness is the point.

A practical tip for typing: decide now whether your passphrase uses spaces. Some sites accept spaces, some strip them, and some reject them. If you are making a master passphrase for a password manager, spaces are usually fine. For individual sites, the manager will generate passwords for you, so this question mostly matters for the one master passphrase you memorise. Test it on the service where you will use it before relying on it everywhere.

One password per important account — without memorising fifty

Here is the part people resist: even a great passphrase should not be reused across your email, bank, and social accounts. If one site leaks it, every account sharing it is exposed. The solution is not memorising fifty passphrases. It is a password manager.

A password manager is an app that generates and stores a unique, long, random password for every site, locked behind one master passphrase — the one you make with the method above. Good free options include Bitwarden; paid options like 1Password add extras such as travel mode and family sharing. Either way, the routine is the same: the manager fills in passwords for you, and you only ever memorise the master one.

Set it up in this order:

1. Install the manager and create your account with a strong master passphrase (the method above).
2. Add your email account first — email is the key to everything else, because password resets go there.
3. Then your bank and payment accounts, then social media.
4. Let the manager generate new random passwords as you visit each site and change them. Do the important five first; the rest can follow over a week.

The first week with a manager feels slower, because you are changing habits. After that it is faster than typing passwords from memory, because the manager fills them in. The common mistake is installing a manager and then continuing to reuse an old password "just for this one site". That one site becomes the weak link. Change the important accounts first, then work through the rest steadily — for example, change five a day until you are done, rather than trying to do fifty in one sitting and giving up halfway.

Also set up the manager on your phone as well as your computer, and make sure you know how to unlock it on both. A manager that only works on one device will tempt you back to memorised, reused passwords when you are away from that device. Most managers sync securely between devices, so set that up at the start and test it before you need it urgently.

Turn on two-factor authentication for the big five

A password, however strong, can still be stolen in a data breach. Two-factor authentication (2FA) means that even with your password, an attacker still needs a second thing — usually a code from an app on your phone. Turn it on, at minimum, for: your email, your bank, your main social accounts, your cloud storage, and any shopping account with a saved card.

An authenticator app (such as Google Authenticator, Microsoft Authenticator, or Authy) is safer than SMS codes, because phone numbers can be hijacked. When you set it up, the service shows backup codes — print those or write them in a notebook kept at home, not in a phone note or a photo. If you lose your phone, those codes are how you get back in.

Setting up 2FA takes about two minutes per account, and it is worth doing in the same order as the password manager: email first, then bank, then the rest. For each account, after turning it on, sign out and sign back in once to prove it works, while you still have the setup screen open. Discovering that 2FA is misconfigured when you are locked out is far worse than spending an extra minute testing it now.

If a service offers a choice between an authenticator app and SMS, choose the app where possible. SMS is still much better than no second factor at all, so if SMS is the only option a service offers, turn it on anyway. And if a service offers a physical security key as an option, that is the strongest choice for your most important accounts, though it is more than most people need for everyday accounts.

What not to do

• Do not use birthdays, anniversaries, children's or pets' names, your team, or your street — all of these are findable or guessable.
• Do not use the same password for your email and anything else. Email is the master key; protect it like one.
• Do not use patterns like "Password1", "Qwerty123", or a single word with a year on the end. Guessing software tries these in the first seconds.
• Do not store passwords in a spreadsheet, a phone note, or an email to yourself. A password manager is built for this; a spreadsheet is not.
• Do not share passwords over chat or email, even with someone you trust. If someone genuinely needs access, use the sharing feature of a password manager or the service's own guest access.

Two more habits to avoid: changing passwords on a fixed schedule for no reason, and using the same "clever" variation everywhere (the same word with a different number per site). Scheduled changes push people towards weaker, incremental passwords, and predictable variations fall quickly once one of them leaks. Change a password when there is a reason — a breach, a shared password, a device you no longer control — and make the new one genuinely different.

If a password has already leaked

It happens to everyone eventually. Go to haveibeenpwned.com and enter your email address — it checks public breach records and tells you which leaks included your details, without asking for your password. If an account of yours appears:

1. Change that account's password immediately, starting with your email account if it is affected.
2. Change any other account that shared the same password.
3. Turn on 2FA for those accounts if it was not on already.

Do not panic and do not pay anyone who emails claiming to have your password — breach blackmail is common, and the leaked password is usually years old.

If you receive one of those blackmail emails, do not reply, do not click links in it, and do not send money. The sender is betting that fear will make you act before you think. Check the breach site, change the affected passwords calmly, and delete the email. If the leaked password is one you still use anywhere, that is the signal to change it everywhere it appears, starting with email.

If this does not work, try this

If you keep forgetting your master passphrase, do not write it on a sticky note on the monitor. Shorten the image, not the security: swap one word for a more vivid one, or practise typing it for a few days before committing to it. Some password managers also offer a printed emergency sheet for the master passphrase, kept somewhere safe at home — that is a reasonable fallback, provided it is not stored with the device it unlocks.

If a site rejects your passphrase, check its rules before weakening it: maximum length limits still exist on some older sites, and a few reject spaces. Adapt by removing spaces or shortening a word, but keep four words and the number and symbol. If a site forces a short maximum, use the manager to generate the longest random password it allows, and let the manager remember it — that is exactly the situation managers exist for.

If you lose access to your authenticator app, use the backup codes you saved at setup. If you did not save them, use the service's account recovery process, which may take time and require proof of identity. That delay is inconvenient, but it is also the reason backup codes matter: save them before you need them, in a place you can find without your phone.

The whole system in one paragraph

One memorable passphrase for your password manager. Unique random passwords everywhere else, generated by the manager. Two-factor authentication on your email, bank, and main accounts. That is the entire system: three habits, and you never have to invent a "clever" password again.

Questions people ask

Is a passphrase really stronger than a complicated short password? Yes, when the words are random. Length multiplies the search space far more than swapping a letter for a symbol does. A short password with symbols looks complex to a person, but a program trying common patterns will reach it far sooner than it reaches four unrelated words.

What if I forget my master passphrase? That is the one password you cannot afford to lose, because it locks everything else. Choose words you can picture, practise typing it for several days, and store the manager's emergency sheet somewhere safe at home. Some managers also offer account recovery options — set those up when you first install the manager, not after a lockout.

Do I need a paid password manager? Not necessarily. A reputable free manager covers the core job: unique passwords, autofill, and sync. Paid versions add convenience features like family sharing, travel mode, and priority support. Start free if cost is a barrier; the important step is using a manager at all, not which tier you choose.

Should I change all my passwords right now? Change the important ones first — email, bank, cloud storage, and any account that shares a password with another account. Then work through the rest over a week or two. Changing everything in one panicked evening usually ends with weak, rushed replacements. Steady beats frantic.

Spotted a step that is out of date? Tell us through the Contact page — corrections are how guides stay accurate.