How to Create a Strong Password You Can Remember

What makes a password strong

A strong password is hard to guess and unique. Real-world attacks don’t rely on random guesses: they use lists of leaked passwords, dictionary words, dates, names, and predictable substitutions everyone makes (changing “a” to “@,” “o” to “0,” or adding “!” at the end). That’s why “J0hn2024!” looks complex but is weak.

What makes the biggest difference is length combined with randomness. Current recommendations from security organizations, such as the U.S. National Institute of Standards and Technology (NIST), favor long, unique passwords over complicated composition rules.

The passphrase method

A passphrase is a sequence of randomly chosen words that aren’t related to each other. Example format: Giraffe-Ship-Cheese-Armadillo-47. Four or five random words make a long password that’s very hard to guess and easy to remember because you can picture a ridiculous scene with them.

1. Open the Password Generator and turn on passphrase mode.
2. Generate a few options and choose one you can picture in your mind.
3. Check the strength and estimated time to crack shown by the tool.
4. Repeat the passphrase a few times over the first few days until you remember it.

The key is that the words must be randomly selected, not chosen by you. Famous quotes, song lyrics, and sayings are on attackers’ lists.

Random passwords for accounts you don’t need to memorize

For most accounts, you don’t need to remember the password: your browser or password manager can store it. In that case, use the generator’s random character mode with 16 or more characters. It’ll be practically impossible to guess, and you’ll never need to type it.

In practice, you only need to memorize a few passwords: for your phone, computer, primary email account, and password manager. Use passphrases for those. See whether a password manager is worth it.

What never to use

• Birthdays, anniversaries, children’s or pets’ names, and favorite sports teams.
• Sequences: 123456, abcdef, qwerty, 112233.
• Your name, government ID number, phone number, or license plate number.
• The same password on multiple accounts, or obvious variations of it (Password1, Password2, Password-Bank).
• Single dictionary words, even with numbers at the end.

A unique password for every service

Reusing passwords is one of the biggest everyday risks. When a website has a data breach, criminals automatically try the same email and password on banks, stores, and social media accounts. If you reuse the password, all those accounts can be compromised at once. Unique passwords limit the damage to the breached site.

To find out if your passwords have appeared in data breaches, see how to check if your email or password was exposed.

A strong password isn't enough on its own

• Turn on two-factor authentication for important accounts: even if your password is exposed, an attacker still needs a second factor.
• Be wary of login pages you open from links in messages: even the strongest password won't protect you if you enter it on a fake site.
• Don't share passwords in messages. If you need to, change the password afterward.
• Change your password if you suspect it was exposed. Changing it regularly for no reason is no longer considered essential if it's strong and unique.

What about your phone and card PINs?

Short numeric passwords, like your phone's PIN, work differently: the device limits the number of attempts and locks after several incorrect entries. Still, avoid obvious PINs like 1234, 0000, 1111, birth dates, and your birth year. If your phone allows it, use 6 digits instead of 4, or choose an alphanumeric password.

For your bank card and banking app PINs, the same rule applies, with one extra precaution: never use your card PIN for anything else, such as your phone PIN or Wi-Fi password, and never share it with anyone—not even someone claiming to work for your bank.

Frequently asked questions