By Haru · Updated · 2026-09-07
How to Create a Strong Password You Can Remember
Length is the only thing that reliably makes a password harder to guess, and almost every rule people remember is about something else. Mixed case, a symbol, a number on the end: those requirements exist because they are easy for a signup form to check, not because they are where the difficulty comes from.
The arithmetic is blunt. Each extra character multiplies the work by the size of the alphabet you are drawing from, so four more lowercase letters multiply it by about 457,000. Swapping an a for an at sign multiplies it by roughly two, because that substitution is one of the first rules any guessing program applies.
What follows is how to build one you will actually remember, which of your own details to keep out of it, and why the number of passwords you need to invent is much smaller than it looks.
Length is the lever, and everything else is a rounding error
A twelve-character password made of ordinary lowercase letters is harder to guess than an eight-character one using every symbol on the keyboard. That comparison surprises people, and it is not close: the longer one wins by a factor of thousands.
The advice here is monotonous because length is doing all the work. Get to sixteen characters or beyond and most of the other questions stop mattering. A passphrase gets there without effort, which is the whole reason to prefer one.
The strength checker on this site shows the same arithmetic from the other direction: it tells you how much one more character would multiply the crack time by, and the number is usually large enough to end the argument.
Two methods that work, and where each one goes wrong
The first is four or five unrelated words joined by a separator. Unrelated is doing the work: apple-banana-orange-grape is a category, and a guessing program that knows the category has far less to search. Pick words from different corners of your life, and pick them without trying to make a sentence.
The second is the first letter of every word in a sentence only you would say. A line from a song your family misquotes, a sentence from a bad review you remember, an odd thing a colleague said. Take the first letters, keep the punctuation, and you have something dense that you can reconstruct rather than recall.
The first method fails when the words come from one theme. The second fails when the sentence is famous, because published quotations are already in the lists. Both are fine otherwise, and neither needs the substitutions people add out of habit.
Keep yourself out of it
Anything a stranger could learn about you in ten minutes is not random, no matter how personal it feels. Your name, your birthday, your children's names, the year you married, the team you support and the dog you post about are all in the same category, and a targeted guess starts there.
The problem is that these details also make a password feel memorable, so they get used precisely where the account matters most. If a phrase means something specific about your life, it belongs in a diary rather than in a password.
A useful test: could someone reconstruct it after scrolling your public posts for a few minutes? If yes, change it, and change it on the accounts you care about first.
Reuse cancels out strength
One excellent password used on ten sites is a weak arrangement, because its strength stops mattering the moment any one of those sites is breached. Attackers take the leaked pairs and try them everywhere else automatically, which is the single most common way ordinary accounts fall.
That also explains why a small change per site does not help much. Adding the site's name to the end produces a pattern, and a pattern across a leaked set is trivial to spot and extend.
The target is not one great password. It is a different password for every account, which is a different problem and has a different solution.
You only have to invent three or four
Almost every password should be long, random and unmemorable, because a manager will type it for you. The handful you must actually remember are the ones that guard the rest: the manager's own password, the device you unlock, and the email account that can reset everything else.
Build those three by hand with one of the methods above, make each one different, and do not store them inside the manager they protect. Everything else can be generated and forgotten.
That is the part of this that changes the workload. Inventing forty memorable passwords is impossible and inventing three is an afternoon.
Changing them on a schedule is old advice
Forced expiry every ninety days was standard for years and has been withdrawn by the people who originally recommended it, including NIST, the American standards body whose guidance most workplace rules copied. Its current text, SP 800-63B-4, tells verifiers not to require changes on a schedule, and advises against composition rules for the same reason. It made passwords worse: people cycled a digit at the end, and the pattern was more predictable than the password it replaced.
Change one when there is a reason. A service announces a breach, you notice a sign-in you did not make, you typed it into a page you now doubt, or you shared it with someone. Those are the moments, and they do not arrive on a calendar.
One exception worth keeping is the account you reused a password on years ago and never fixed. That one is overdue regardless of what any policy says.
Sources NIST SP 800-63B — Digital Identity Guidelines
Frequently asked questions
Is a passphrase really safer than a short complex password?
Yes, and not marginally. Four unrelated words come to something like fifty to sixty characters of typing at worst, and the guessing work grows with every one of them. A short password stuffed with symbols is guessed by a program that already expects symbols. The only case where the short one wins is when a site caps the length, which is worth noticing when you sign up.
Do I have to use a password manager?
You do not, but the alternative is remembering dozens of unrelated passwords, which nobody does, so in practice people reuse instead. If you would rather not install one, the fallback is a written list kept somewhere physically safe and separate from the device, which is unfashionable advice but far better than reuse.
Are the passwords a manager generates better than mine?
For everything except the three or four you have to type from memory, yes. A generator produces strings with no structure at all, which is exactly what a human cannot do reliably. Keep the handmade ones for the accounts where you have no choice.
Is it safe to type my password into a strength checker?
It depends entirely on the page, which is why the honest answer is to test a password of the same shape rather than the real one. Ours does the work in the browser and sends nothing, and you can confirm that yourself in the network panel, but that habit is worth keeping everywhere.
What about the security questions underneath?
They are usually the weakest part of an account, because the true answers are guessable and often public. Treat them as extra passwords: put random text in them and store that text with the password rather than answering honestly.
How do I know if one of mine has already leaked?
Most password managers and some browsers run that check against known breach lists, and that is the right place to do it because they already hold your passwords. We deliberately do not offer that check, since it would mean sending something to a server we do not need to involve.