How to create a strong password you can actually remember

Learning how to create a strong password is easier than the usual rules suggest. You do not need a baffling mix of symbols that you forget by next week. What protects you most is length, randomness and using a different password for every account.

This guide explains what actually makes a password hard to crack, shows a simple method for building passwords you can remember, and covers how to handle the dozens of logins most people have without writing them on a sticky note.

What makes a password strong?

Attackers rarely guess passwords by hand. They use software that tries billions of combinations, starting with leaked passwords, common words, names, dates and predictable patterns such as a capital first letter and a number or exclamation mark at the end.

A strong password resists that process in three ways. It is long, because each extra character multiplies the number of possible combinations. It is unpredictable, meaning it is not based on personal details or common phrases. And it is unique, so a leak from one website cannot unlock your other accounts.

• Long: at least 15 characters, and longer for important accounts
• Unpredictable: no names, birthdays, pet names, sports teams or keyboard patterns
• Unique: never reused on another site

How long should a password be?

Length matters more than complexity. An eight-character password with symbols can be cracked far faster than a 20-character phrase made of ordinary words. Current guidance from the US National Institute of Standards and Technology (NIST) favors longer passwords and discourages forcing people to follow complicated composition rules.

As a practical rule, aim for at least 15 characters for everyday accounts and 20 or more for your email, banking and password manager. If a site allows long passwords, use that room.

Length, randomness and uniqueness protect you far better than a jumble of symbols you will forget by next week.

The passphrase method: strong and memorable

A passphrase is a password made of several random words. Four to six unrelated words give you length and unpredictability while staying easy to picture and type. The key word is random: a famous quote or song lyric is easy for cracking software to find.

To build one, pick words that have no connection to each other or to you. Rolling dice against a word list is the most random way, but opening a book to random pages and taking the first noun you see also works. Join the words with spaces, hyphens or another separator, and add a number or symbol if the site requires it.

• Weak: Sunshine1! (common word, predictable number and symbol)
• Weak: ILoveMyDogMax (personal and guessable)
• Strong: copper-lantern-orbit-pickle-meadow
• Strong: velvet tractor 7 glacier umbrella

Why reusing passwords is the biggest risk

Data breaches happen constantly, and stolen email and password pairs are sold and shared. Criminals then try those pairs on other websites, a technique called credential stuffing. If you use the same password for a small forum and for your email, a breach at the forum becomes a breach of your email.

This is why a unique password for every account matters more than any single password being perfect. Nobody can remember a hundred unique passphrases, which is where a password manager comes in.

Use a password manager for everything else

A reputable password manager stores your passwords in an encrypted vault, generates long random passwords for new accounts and fills them in for you. You only need to remember one strong master passphrase. Most phones and browsers now include a built-in password manager, and dedicated password managers add features such as sharing and cross-platform syncing.

Make your master passphrase the strongest one you own, never use it anywhere else, and protect the vault with two-factor authentication. Let the manager generate random passwords for all other sites; you will not need to memorize them.

Should you change your passwords regularly?

Not on a fixed schedule. Forced changes every few months tend to produce weaker passwords, because people make small predictable tweaks such as adding a number. Current NIST guidance advises against routine expiry.

Do change a password immediately if a service reports a breach, you receive an alert about a suspicious sign-in, you shared it with someone, or you typed it into a site that turned out to be fake.

How to check if your password has been leaked

Many built-in password managers in browsers and phones include a password checkup that warns you about passwords found in known breaches, reused passwords and weak ones. Run it and fix the flagged accounts, starting with the most important.

Breach-notification services can also tell you whether your email address has appeared in a known data leak. If it has, change the password for that site and anywhere else you used the same one.

Go further: 2FA and passkeys

Even a perfect password can be stolen through a phishing page. Turning on two-factor authentication means a stolen password alone is not enough to get in. Use it on email, banking, social media and your password manager at minimum.

Many services now also support passkeys, which replace the password with a login tied to your device and unlocked by your fingerprint, face or screen PIN. They cannot be phished or reused, so switch to them wherever they are offered.

Frequently asked questions

A strong password does not have to be painful. Build long passphrases from random words for the few logins you type yourself, let a password manager create unique passwords for everything else, and add two-factor authentication or passkeys to your key accounts. Spend an hour fixing your most important logins today, and the rest of your accounts can follow over the coming weeks.

How we research: Guides are written from established sources and checked for accuracy. They are general information, not professional advice.