How to Create a Strong Password You Will Actually Remember

Here is an uncomfortable truth: the average person has over 100 online accounts — and most people reuse the same three or four passwords across all of them. When one site gets hacked (and sites get hacked all the time), every account sharing that password is instantly at risk.

The problem is not that people are careless. It is that genuinely strong passwords — the kind that security experts recommend — look like this:

Nobody can remember that. So people fall back to password123 or their pet's name, which takes an attacker about three seconds to crack.

The good news: there is a method for creating passwords that are both highly secure and genuinely memorable. And once you know it, you will never struggle with passwords again.

What actually makes a password strong?

Password strength comes down to two things: length and unpredictability. Everything else is secondary.

• Length — a 20-character password made of random words is dramatically harder to crack than an 8-character password with symbols. Every extra character multiplies the difficulty exponentially.
• Unpredictability — passwords based on real phrases, birthdays, names or dictionary words are vulnerable to dictionary attacks. Random combinations are not.
• Uniqueness — using the same password across multiple sites means a single breach exposes everything. Every account needs its own password.

The memorable password method — passphrases

A passphrase is a password made from multiple random words joined together. It looks like this:

These are genuinely secure — a four-word passphrase has more possible combinations than a random 10-character string of symbols. But unlike that string of symbols, a passphrase can actually be remembered because your brain is very good at creating a mental image: a tiger next to a lamp being brave in the north.

The rules for a good passphrase

• Use at least 4 words — three words is borderline; four or more is solid
• Choose words randomly — don't pick words that relate to you personally (your city, your hobby, your kids' names)
• Separate words with a hyphen, dot or number — this satisfies most sites' "must include a symbol" requirement
• Capitalise the first letter of each word to satisfy uppercase requirements
• Add a number at the end if required — but make it random, not your birth year

When to use a fully random password instead

Passphrases are ideal for accounts you log into regularly — email, banking, social media — because you need to actually type them sometimes. But for accounts you access rarely (an old shopping site, a forum you joined once), a fully random password stored in a password manager is even more secure.

Random passwords look like this:

You cannot memorise this — and you do not need to. That is what password managers are for.

The tool that solves everything — a password manager

A password manager stores all your passwords securely, generates new ones when you need them, and fills them in automatically. You remember one strong master passphrase — the manager handles everything else.

This is the single most impactful thing you can do for your online security.

The 5 most common password mistakes

• Reusing passwords — the single most dangerous habit. One breach exposes everything.
• Using personal information — names, birthdays, addresses, pet names. These are all guessable.
• Simple substitutions — replacing a with @, e with 3, o with 0. Attackers know all these tricks.
• Short passwords — anything under 12 characters is vulnerable to brute-force attacks with modern hardware.
• Not enabling two-factor authentication — even the best password benefits from 2FA as a backup. Enable it everywhere you can.

The quick summary

• Use a passphrase of 4+ random words for accounts you log into regularly
• Use a random password stored in a manager for everything else
• Never reuse passwords across different sites
• Enable two-factor authentication wherever possible
• Bitwarden is the best free password manager — takes 5 minutes to set up