Creating Strong, Memorable Passwords

Your password is the front door to most of your online accounts. Unfortunately, that door is often protected by a weak lock: people reuse short, predictable passwords across many sites. This guide covers why passwords get cracked, what actually makes a password strong, and how to create passwords that are both easy to remember and hard to break.

Understand the threat first

Attackers rarely guess passwords by hand. They rely on two much more effective methods:

• Brute-force attacks: computers try millions of letter, number and symbol combinations per second. A short password made only of letters and digits can be cracked very quickly on modern hardware.
• Leaked credential lists and reuse: billions of username/password pairs have leaked in past data breaches. Attackers take these lists and try them on other sites, this is called credential stuffing↗. Because most people reuse passwords, a single leak can compromise millions of unrelated accounts.

So a password is strong when it is long and complex enough to resist guessing, and unique to every account.

What if your password was already leaked?

If you suspect your information may have been exposed in a breach, act quickly:

1. Check whether your email appears in a known breach using a breach-checking service such as haveibeenpwned.com.
2. Immediately change the password on any affected account to a new, strong one.
3. Change that same password anywhere else you may have reused it.
4. Turn on two-factor authentication↗ on all important accounts.
5. Watch for a spike in phishing↗ emails or messages after a breach, and avoid clicking suspicious links.

What makes a password strong?

A strong password cannot realistically be brute-forced and is not easy to guess. If you remember one rule, make it this: length matters more than complexity. Still, combining both is best.

Key characteristics of a strong password

• At least 12 characters, longer is better. Every extra character multiplies the number of possible combinations.
• A mix of character types: upper and lower case letters, numbers and symbols.
• No keyboard patterns or sequences: avoid things like qwerty, 123456, or abcabc, these are tried first.
• Nothing personal: avoid names, birthdays, pet names or anything else that could be linked back to you.
• Unique: different for every account.

Length beats complexity

Length is genuinely the deciding factor in password strength. Aim for at least 12 characters, more if possible. As long as you avoid common phrases, a sufficiently long password becomes practically uncrackable.

Avoid common and well-known passwords

Words like "password", "12345" or "qwerty" are some of the most common (and useless) passwords in the world, they sit at the top of every attacker's list.

Don't use personal information

A nickname, birthdate or pet's name might feel unique, but it usually isn't hard to find, from your social media, your public profile, or casual conversation.

Make every account unique

It's tempting to reuse one strong password everywhere, but that leaves you exposed to a single breach cascading across everything. If an attacker gets that one password, they get your email, your social media, and your work accounts too. Never reuse a personal password for a work account.

Don't reuse old passwords

If you've used a password before, especially one exposed in a past breach, don't use it again, even years later.

Use special characters

Special characters (! @ # $ % ^ & * ? -) are an effective way to strengthen a password. Not every site accepts every symbol, but most accept the common ones, use them wherever you can.

Examples of strong passwords

The following are long (15+ characters), mix upper/lower case, numbers and symbols, and contain no personal information or keyboard patterns:

• q7$Rm2!vXc9pLZ#a
• %8nKpZ^r4Tg!hUbW3
• vR2#tQ9!mE7sNb$Yk

You don't need to memorize any of these, a password manager↗ (below) will handle that for you. But for the passwords you do need to remember, there are strong and memorable techniques too.

Ways to create strong, memorable passwords

1. Use a password generator

If you don't want to think one up yourself, a password generator produces a random, strong password in seconds. Most browsers (like Chrome) and password managers suggest one automatically when you create a new account, just accept the suggestion and save it.

2. Three random words (a passphrase↗)

The easiest way to remember a long, strong password is to combine three or four unrelated random words. Passphrases resist brute-force attacks because of their length, and adding a number or symbol makes them even stronger.

• coffee-blue-forest → stronger: Coffee7-Blue!Forest
• lemon book wind → L3monBook#Wind

Important: avoid common phrases and idioms, these are vulnerable to dictionary attacks. What you want is randomness.

3. Build a password from a sentence

Pick a sentence only you would remember, take the first letters of each word plus any numbers and punctuation, then swap some letters for numbers or symbols. The result looks random but is meaningful to you.

• "I drink 2 cups of coffee every morning and love it!" → Id2coEm&lI!
• "I bought my first house at 27 in Boston." → Ibmfha27iB.

4. Combine several dictionary words with numbers and symbols

A single dictionary word is easy to guess, but a few random ones stitched together with numbers and symbols make a very strong password:

• puzzle · search · fork → Puzz1e_Search_F0rk5
• glance · gear · koala → Gl@nce.Gear.K0ala!

5. A different variant per account

Once you have a strong "root" password, you can add a short, personal suffix for each account, one logic to remember, a different password on every account (just make the suffix non-obvious).

• Root: q7$Rm2!vXc · Email → q7$Rm2!vXc-eml
• Root: q7$Rm2!vXc · Shopping → q7$Rm2!vXc-shp

Note: this is practical, but the safest approach is a password manager that assigns completely independent passwords per account.

6. Muscle memory

Practice typing a password you need to memorize a few times. With enough repetition your fingers "just know" it, which makes recall much easier.

Keeping your passwords safe

Once you've created strong passwords, the next step is protecting them. Here are the most effective habits.

Use a good password manager

Remembering dozens of unique passwords is impossible, which is why people fall back on reuse. The solution is a password manager: it generates, stores and auto-fills all your passwords in one encrypted vault. You only need to remember one strong master password, it handles the rest, including which username you used where.

Browsers' built-in password vaults are a solid starting point. If you'd rather avoid an online service, free offline options exist too (such as KeePass). Whichever you choose, make your master password very strong and, if possible, protect it with two-factor authentication.

Turn on two-factor authentication

Even if someone steals your password, two-factor authentication (2FA) asks for a second piece of proof before letting them in. That second factor can be a one-time code from an authenticator app, an approval push to your phone, or a security key↗.

Receiving codes by SMS is better than nothing, but attackers can steal your number through SIM-swap fraud. Where possible, prefer an authenticator app (like Google or Microsoft Authenticator, or Authy) or, stronger still, a passkey↗ or hardware security key.

Don't store passwords in plain text

Don't write your passwords in a notes app, email, or an unencrypted document, these can be compromised. If you must write one down, encrypt the file with a strong password, or better, use a password manager.

Monitor your email for breaches

Your email account is the key to your other accounts, so it's worth tracking whether it has appeared in a breach. Breach-checking services let you enter your email to see if it's known to be exposed, and some can alert you to future breaches too.

Never share your passwords

Sending a password by text or email, even to someone you fully trust, is risky, since those messages can be intercepted. Reading it aloud over the phone, or spelling it out to someone nearby, can be overheard too. If you truly need to share access, use your password manager's secure sharing feature.

Summary

Strong password hygiene comes down to three simple rules:

• Use long and unique passwords (three random words is a great starting point).
• Store them all in a password manager.
• Turn on two-factor authentication for important accounts.

Do these three things and you neutralize the vast majority of common account-takeover attacks. Start with your most critical accounts first: email, banking, and social media.

Even the strongest password isn't enough on its own, real security comes from combining a long, unique password, a password manager, and two-factor authentication.

Related reading

Protect Your Accounts with Two-Factor Authentication

The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.

Passkeys: The Password-Free Way to Sign In

Passkeys let you sign in with your fingerprint or face instead of a password, and they're resistant to phishing by design. Here's how they work and how to start using them.

Modern Authentication Architecture: Passwords, Passkeys, and Beyond

How passwords, passkeys, cryptography, and secure design fit together into a coherent authentication strategy, for teams designing systems, not just using them.