How to Create a Strong Password You'll Actually Remember

When a website is breached, attackers usually get a list of scrambled (hashed) passwords. They then run cracking software that hashes guesses and looks for matches. A modern graphics card can test billions of guesses per second against weakly protected hashes, so the question isn't whether a guess is tried, it's how early in the list your password appears.

Cracking tools don't start at "aaaa" and work forward. They start with what humans do. Three habits put a password near the front of the queue:

1. Dictionary words and names

Wordlists contain every dictionary word in dozens of languages, plus names, places, sports teams, song lyrics, and every password from past breaches. "Liverpool1987" or "Summer2026!" looks random to you but is a few seconds of work for a cracker, because both pieces are in its lists and the combination rules are obvious.

2. Predictable patterns and substitutions

Capitalizing the first letter, adding a number and a symbol at the end, and swapping letters for look-alikes (a to @, o to 0, s to $) are so common that cracking software applies them automatically. "P@ssw0rd!" feels clever and is cracked almost instantly. Keyboard walks like "qwerty", "1qaz2wsx", or "asdfgh" are in every list too.

3. Reuse across sites

Reuse is the biggest risk of all, because it makes strength irrelevant. If one site leaks your email and password, attackers try that pair on email providers, banks, retailers, and streaming services. This is called credential stuffing, and it's how my sister lost her account. A perfect password used in two places is only as safe as the weaker of the two sites.

Length beats complexity. Every extra character multiplies the number of possible combinations, while a single symbol tacked on the end adds very little. A long password made of random elements is the goal.

There are two good ways to build a strong password, and each has a job.

Random strings: best for things you never type

A random string like "v7#Qm2!tLx9@pR4w" is extremely strong for its length because every character is unpredictable. The downside is that no normal person can remember dozens of them. That's fine — you're not supposed to. Random strings belong in a password manager, which fills them in for you. Use a generator such as our Password Generator to create them at 16 characters or more.

Passphrases: best for the few you must memorize

A passphrase is a sequence of several unrelated words, such as "copper-tadpole-insist-velvet-orbit". It's long, easy to picture, and easy to type on a phone. The key word is unrelated. A famous quote, a song lyric, or a sentence about your life is not random and may already be in a wordlist.

To make a passphrase properly:

1. Pick five or more words at random. Truly random selection matters, so use dice with a published word list (the "diceware" method) or a trusted generator rather than choosing words yourself.
2. Join them with a separator you like, such as hyphens or spaces, if the site allows.
3. Picture a silly scene that links the words — a copper tadpole insisting on velvet in orbit. Strange images stick in memory far better than strings of characters.
4. Type it a few times over the next couple of days. After about a week, most people know it by heart.

Five random words from a large list produce a passphrase that would take an attacker an impractical amount of time to guess, even with fast hardware, while still being something you can recall on a Monday morning.

Which passwords need memorizing?

• Your password manager's master password.
• Your main email account, since it can reset almost everything else.
• Your computer or phone login.

That's usually it. Three strong passphrases in your head, and random strings for everything else.

Password managers sound technical, but the daily experience is simpler than typing passwords yourself. Most browsers and phones now include one, and dedicated apps add features like sharing with family and breach alerts. Here's a routine that works without turning it into a weekend project.

1. Choose one manager and stick with it. The built-in options from Apple, Google, and Microsoft are fine for most people; standalone apps work across every device and browser.
2. Protect it with a strong passphrase you've memorized, and turn on two-factor authentication for the manager account.
3. Start with your most important accounts: email, banking, phone carrier, and anything with stored payment details. Change each to a fresh random password saved in the manager.
4. Fix the rest as you go. Each time you log in somewhere with an old password, let the manager generate a new one. Within a few months, most of your accounts are covered without a dedicated cleanup session.
5. Turn on two-factor authentication wherever it's offered, preferably with an authenticator app or passkey rather than text messages.
6. Write down your recovery codes and master passphrase and store the paper somewhere safe at home. Losing access to the manager is a bigger everyday risk than someone breaking into your house to read a note.

Many sites now offer passkeys, which replace the password entirely with a key stored on your device. Where you see that option, it's worth taking — passkeys can't be phished or reused. Your password manager can usually store them too.

A generator removes the human patterns that make passwords guessable. But the generator itself has to be trustworthy, because it's the only thing that ever sees the result.

• Use a generator that runs on your device. Our Password Generator builds passwords in your browser with the operating system's cryptographically secure random number source. Nothing is sent to a server or stored.
• Avoid sites that generate passwords on their server and send them back to you. You have no way to know whether they log what they produced.
• Go long. Choose 16 characters or more for random strings. If a site caps length, use the maximum it allows.
• Include all character types the site accepts. If a site rejects certain symbols, turn those off rather than shortening the password.
• Generate a new password for every account. Never generate one and reuse it.
• Save it to your password manager before you submit the form, so a page error doesn't leave you locked out.

A quick sanity check: if you could recite a generated password after one glance, it probably isn't random enough for an account you care about.

Strength meters are helpful for checking a passphrase you created or an older password you're deciding whether to keep. The catch is that some online checkers send what you type to their server. Typing a real password into an unknown website is exactly the habit we're trying to break.

Our Password Strength Checker runs entirely in your browser. It estimates crack time, flags missing character types, and points out common patterns, without the password leaving your device. You can confirm that yourself: load the page, switch off your Wi-Fi, and the checker still works.

When reading the result:

• Treat crack-time estimates as a comparison, not a promise. They assume a particular attack speed, and real attackers vary.
• A high score doesn't fix reuse. A strong password used on two sites is still at risk if either one is breached.
• If a familiar password scores poorly, replace it rather than tweaking it. Adding "2" to the end is exactly what cracking rules expect.

If you want a broader picture of what other personal data your files might be leaking, our guide to what EXIF data is covers the hidden details in everyday photos.

How long should a strong password be?

At least 16 characters for a random string stored in a password manager, and at least five random words for a passphrase you memorize. Longer is better whenever a site allows it.

Is it safe to write passwords down?

Writing down one or two master passphrases and keeping the paper at home is reasonable for most people. Sticky notes on a monitor at work, or a notes app with no protection, are not.

How often should I change my passwords?

Current guidance from security agencies such as NIST in the US and the NCSC in the UK is to change a password when there's a reason — a breach, a suspicious login, or a shared password — not on a fixed schedule. Forced frequent changes tend to produce weaker, predictable passwords.

Are browser password managers good enough?

For most people, yes. They generate random passwords, sync across your devices, and warn you about reused or breached passwords. Standalone managers are useful if you switch between different browsers or need to share logins with family.

Does a password generator know my password?

A client-side generator creates the password on your device and doesn't send it anywhere, so no one else ever sees it. That's why it's worth choosing one that runs locally rather than on a remote server.