How to Create a Strong Password You Can Actually Remember

Most of us were taught the same recipe: one capital letter, one number, one symbol, and change it every few months. The result is something like Summer2026!, which is hard to remember when it’s new and even easier to guess than you’d think.

The good news is that better advice exists, and it’s easier to follow.

Length beats complexity

Every extra character multiplies the number of guesses an attacker needs. A long password made of simple pieces is usually stronger than a short one full of symbols. Security guidance from standards bodies such as NIST has moved in this direction too: favour length, and stop forcing odd character rules and frequent changes for no reason.

Try a passphrase

A passphrase is several random, unrelated words strung together, like copper-lantern-orbit-pickle. It’s long, it’s easy to picture, and it’s hard to guess.

• Use four or more words.
• Make them truly random. A famous quote or song lyric is much easier to guess.
• Don’t use personal details such as pet names, birthdays or your street.

When to use a random password instead

For most accounts you won’t type the password yourself because a password manager will fill it in. In that case, let a generator make a long random one. Use the secure password generator, which uses your browser’s cryptographic random source and creates the password on your device. Pick a length of 16 or more characters.

Never reuse a password

This is the rule that matters most. When a website is breached, attackers try the leaked email and password on other popular sites. If you reuse one password, a single breach unlocks all of your accounts. Unique passwords limit the damage to one account.

Use a password manager

You can’t memorise fifty unique passwords, and you shouldn’t try. A reputable password manager remembers them for you. You only need to remember one strong passphrase to unlock it. Many browsers and phones also have a built-in manager that does the basics.

Turn on two-factor authentication

A second step, such as an app code or a security key, protects you even if your password leaks. Start with your email, banking and any account that can reset others. An authenticator app or security key is generally safer than text messages.

Check how strong a password really is

If you’re curious about a password’s length and character mix, the password strength checker gives a transparent estimate, locally in your browser. One caution: don’t type a password you use for a real account into any website you don’t trust. Test a similar one instead.

A short checklist

1. Make it long: 14 characters or more, ideally a passphrase.
2. Make it unique for every account.
3. Store it in a password manager.
4. Add two-factor authentication to important accounts.
5. Only change a password when you have a reason, such as a breach or sharing it.

It takes an evening to set up and removes one of the most common ways accounts get taken over. That’s a good evening’s work.