How to Create Strong Passwords You Can Remember
A password protects your email, bank, shopping and social accounts. Criminals guess common passwords and reuse leaked ones on many sites. A strong password is long, unique to each account and hard to guess. You do not need to memorise dozens of random strings to achieve this.
What makes a password strong
- Length: longer is much stronger. Aim for at least 12 to 16 characters.
- Unpredictability: avoid names, birthdays, pet names and simple patterns such as "123456" or "password1".
- Uniqueness: use a different password for every important account.
Use a passphrase
A passphrase is several unrelated words joined together, such as "lantern-orbit-marble-quiet". It is long and easy to remember, and it is harder to guess than a short complex password. Pick words at random from your own mind or from a dictionary, and do not use a famous quote or song lyric.
Do not reuse passwords
When a website is hacked, criminals try the leaked passwords on other sites. If you reuse one password, a breach at a minor shop can give access to your email. Use a password manager to keep each password unique, as explained in how to use a password manager.
Where to store the passwords
| Option | Safety |
|---|---|
| Password manager | Best choice for most people |
| Written in a notebook kept at home | Acceptable if kept private and secure |
| Note on the computer or phone | Risky if the device is lost or infected |
| Same password for everything | Not safe |
Change passwords after a breach
Some websites and services notify you of breaches. Change the password on the affected site and on any other site where you used the same one. Check whether your email address has appeared in a known breach using the breach checker offered by many password managers and security companies.
Add a second layer
A strong password works best with two-factor authentication. Turn it on for email and banking first. See what two-factor authentication is.
Frequently asked questions
How often should I change my password?
Change it when there is a sign of a breach, or when you suspect a device or account has been compromised. Frequent forced changes often lead to weaker passwords.
Are symbols and numbers necessary?
They help when the password is short. A long passphrase is strong even without them, as long as it is unique and not a common phrase.
Why length beats complexity
A password made of several random words is usually longer and easier to remember than a short string with symbols. Attackers use tools that try common patterns very quickly, so length makes the most difference. Complexity rules that require one capital letter and one symbol often push people toward predictable choices, such as a capital at the start and an exclamation mark at the end.
Plan for a password change
Keep a list of your most important accounts, and make sure each has a unique password and a recovery email or phone number you can still reach. When you change a password, check the recovery options at the same time. Losing access to a recovery email is one of the most common reasons people cannot regain control of an account.
Related reading
- What Is Two-Factor Authentication and How to Turn It On: How two-factor authentication protects accounts, the different kinds of second step, and how to enable it on email, banking and social accounts.
- How to Use a VPN: What It Does and What It Does Not Do: What a VPN does for privacy and public Wi-Fi, what it cannot protect against, and how to choose and set up a reputable VPN service.
- Why Your Computer Is Stuck on a Loading Screen: What to try when a computer gets stuck on a loading or spinning screen after an update, restart or startup: patience, safe mode, startup repair and backups.