Blog / Create a strong password you can remember

How to Create a Strong Password You Can Actually Remember

Most of us have, at some point, typed a pet's name, a birth year and an exclamation mark and called it a password. It feels personal and easy to remember. It is also exactly the kind of thing attackers try first.

A strong password does not have to be painful. It comes down to a few habits, and you only need to memorise one or two of them.

Length beats clever tricks

Swapping an a for @ or an o for 0 feels clever, but password-guessing tools know every one of those swaps. They are built into the tools. A password like P@ssw0rd! is not much better than the plain word it came from.

What actually helps is length. Every extra character multiplies the number of possibilities an attacker has to try. Current guidance from standards bodies such as NIST leans the same way: favour long passwords and stop forcing odd symbol rules on people.

For most accounts, let a generator do it

People are bad at being random. We pick words, dates and patterns, and attackers know our habits. A generator has no habits.

1. Open the Password generator.
2. Set the length to 16 or more with the slider.
3. Keep uppercase letters, numbers and symbols ticked. Some sites reject certain symbols, so untick symbols if a site complains.
4. Press Generate password, then Copy.
5. Paste it into the site's password field and save it in your password manager.

The generator uses your browser's built-in secure random number source. The password is made on your device and is not sent or stored anywhere. A random 16-character password is impossible to memorise, and that is fine. You are not meant to.

For the few you must remember, use a passphrase

Some passwords you will type from memory: your phone, your email and the master password for your password manager. For those, four or five unrelated words work better than a short jumble of symbols. They are long, and they are easy to picture.

The words have to be unrelated and chosen at random. A line from a song, a famous quote or words that describe you are not random, and guessing tools try those first. Do not pick words that belong together, like a name and a place.

One password for one account

Websites get breached. When it happens, the leaked emails and passwords are tried on other sites, such as your email, your bank and your social media. If you reused the password, one leak becomes several. A different password for every account matters more than almost anything else in this article.

Let a password manager remember the rest

A password manager stores all those long random passwords and fills them in for you. You remember one strong passphrase and the manager holds everything else. The password manager built into your phone or browser is a perfectly reasonable place to start, and dedicated apps add more features if you want them.

Add a second step

Turn on two-step verification wherever it is offered, starting with your email account, because that is how most other accounts get reset. Even if someone learns your password, they would still need the code from your phone. An authenticator app is generally safer than codes sent by text message.

What to avoid

• Names, birthdays and phone numbers, yours or anyone else's.
• Common choices such as 123456, qwerty and password.
• The same password with a number added at the end that you change from site to site.
• Sending a password in a chat message or email.
• Saving a list of passwords in a plain note on your phone with no lock.

Pick a strong passphrase for the few things you must remember, let a generator and a manager handle everything else, and switch on two-step verification. That covers most of what matters.