How to Create a Strong Password You Can Actually Remember
Length beats complexity. Learn how attackers crack passwords, what entropy means, and how passphrases and password managers keep you safe.
Most account takeovers do not involve clever hacking. They happen because people reuse passwords that have already leaked, or choose ones that are easy to guess. A few habits make you dramatically harder to attack.
How passwords get cracked
- Credential stuffing: attackers take email and password pairs leaked from one breached site and try them automatically on thousands of others. This is the most common threat, and only unique passwords stop it.
- Dictionary attacks: guessing common passwords and words with predictable tweaks, like "Summer2024!" or "P@ssw0rd". Billions of real leaked passwords are used as the starting list.
- Brute force: trying every combination. Only practical against short passwords, but modern graphics cards can test billions of guesses per second against stolen password hashes.
- Phishing: tricking you into typing your password into a fake site. Two-factor authentication is the main defense.
What makes a password strong
Strength comes from unpredictability, measured in bits of entropy. Each extra bit doubles the number of guesses needed. Entropy depends on length and on how many characters could appear in each position:
| Password type | Example | Approx. entropy |
|---|---|---|
| 8 lowercase letters | kqmzvhta | 38 bits |
| 8 mixed characters | r7#Kq2!m | 52 bits |
| 12 mixed characters | y4&Rt9qZ!w2L | 79 bits |
| 16 mixed characters | (random) | 105 bits |
| 5 random common words | orbit-candle-mango-ripple-statue | about 65 bits |
The numbers only hold if the password is truly random. "Password123!" uses all four character types but appears in every attacker's dictionary.
Passphrases: strong and memorable
For the few passwords you must remember, such as your computer login and password manager master password, use a passphrase of four to six randomly chosen words. "correct horse battery staple", made famous by the webcomic xkcd, illustrates the idea: random words are easy to picture and type but hard to guess. The key word is random; a quote or song lyric is not random.
Use a password manager for everything else
Nobody can remember dozens of unique random passwords. A password manager generates, stores and fills them for you, protected by one strong master password. Reputable options include Bitwarden, 1Password, and the managers built into Apple, Google and Microsoft accounts. A manager also protects against phishing, because it will not auto-fill on a fake domain.
Turn on two-factor authentication
Two-factor authentication (2FA) means a stolen password alone is not enough. Prefer, in order: hardware security keys or passkeys, authenticator apps, then SMS codes. Enable it first on your email account, because email is used to reset every other password.
Current official guidance
The US National Institute of Standards and Technology (NIST) now recommends long passwords, checking new passwords against lists of breached ones, and not forcing regular password changes unless there is evidence of compromise. Forced changes tend to produce predictable patterns like Spring2025, Summer2025.
Checklist
- Use a unique password for every account.
- Make passwords at least 12–16 characters; use the password generator for random ones.
- Store them in a password manager.
- Turn on 2FA, starting with email and banking.
- Change a password immediately if a service reports a breach.