How to Create a Strong Password You Can Actually Remember

"Use at least 8 characters with a capital letter, a number and a symbol." That advice produced millions of passwords like Password1!, which attackers guess in seconds. Here's what actually makes a password strong.

How passwords really get cracked

Attackers rarely guess passwords one by one on a login page. Usually a website's database is stolen, and they run billions of guesses per second against the stolen hashes, using:

• Lists of leaked passwords. Billions of real passwords from previous breaches are tried first.
• Dictionary words with tweaks. Summer2024!, P@ssw0rd, names plus birth years.
• Keyboard patterns such as qwerty123 and 1qaz2wsx.
• Brute force for short passwords: every possible combination.

Length beats complexity

Every extra character multiplies the number of possible passwords. A random 8-character password using every symbol on the keyboard has about 6 quadrillion combinations, which sounds like a lot until you learn that a single gaming graphics card can test billions of fast hashes per second.

A 16-character password, even using only lowercase letters, has about 43 sextillion combinations, millions of times more than that.

The passphrase method

Pick four to six random words and join them:

canyon-pickle-orbit-velvet-ladder

It's long, easy to type and easy to remember, and if the words are chosen randomly it's extremely hard to crack. The key word is random: a phrase you invent, like a song lyric, follows predictable patterns. The passphrase generator picks words randomly from the EFF list made for exactly this purpose.

The rules that actually matter

1. Use a different password for every account. When one site is breached, attackers try the same email and password everywhere else. This is the most important rule.
2. Make it long. 12 characters minimum, 16+ for important accounts.
3. Avoid personal information: names, birthdays, phone numbers, cricket teams, pets.
4. Don't just substitute letters. P@$$w0rd is in every cracking list.
5. Turn on two-factor authentication for email, banking and social media, so a stolen password alone isn't enough.

Remembering dozens of passwords

You can't, and you shouldn't try. Use a password manager (many browsers and phones have one built in, and there are dedicated apps). Then you only need to remember one strong passphrase for the manager itself.

Check your existing passwords

The password strength checker estimates how long a password would take to crack and can check whether it has appeared in a known data breach. The check runs in your browser, and only a partial hash is ever sent for the breach lookup, never the password itself. Still, never type the real password of an important account into a website you don't trust.

For random passwords for new accounts, use the password generator and save the result straight into your password manager.