How to create a strong password (that you can actually remember)

Most password advice is either too vague ("make it complex") or too demanding ("use a different 20-character random string for every account"). Neither is useful in practice. This guide gives you the actual principles behind password security, two practical methods for creating strong passwords, and the honest answer to the question of how many passwords you actually need to remember.

What "strong" actually means

A password is strong when it would take an unreasonable amount of time to guess, even with automated tools trying millions of combinations per second. Two factors determine this:

Length

The most important factor. Every extra character multiplies the number of possible combinations exponentially. An 8-character password with letters, numbers and symbols has around 7 quadrillion combinations — sounds like a lot until you realise modern hardware can crack it in hours. A 16-character password has so many more combinations that the same hardware would take longer than the age of the universe.

The minimum for any password you want to be secure: 12 characters. 16 or more is better. For a master password you'll type regularly, 20–25 characters using the passphrase method (below) is both achievable and very secure.

Unpredictability

Length only matters if the password isn't guessable from patterns. Attackers don't try every possible character combination starting from "aaaaaaa" — they use wordlists of commonly used passwords and known patterns first. "Password1!" has all the right character types but takes seconds to crack because it's on every wordlist. "correct-horse-battery-staple" (random words, no obvious connection) takes orders of magnitude longer despite being easier to remember.

Things that make passwords predictable:

• Words from the dictionary, especially single words
• Personal information — names, birthdays, pet names, places
• Common substitutions — @ for a, 3 for e, 0 for o — these are in the wordlists
• Patterns — Qwerty123, abc123, 123456
• Capitalising only the first letter and adding a number and symbol at the end — Password1! — this pattern is so common it's in every attack dictionary

Method 1: The passphrase

Take four or more unrelated words, chosen at random, and combine them. The NCSC (National Cyber Security Centre) specifically recommends this approach for passwords you need to remember.

Examples (do not use these — generate your own):

• correct-horse-battery-staple
• purple-cloud-seven-hammer
• ocean-lamp-friday-brick

Why it works: the length (typically 20–30 characters) makes it computationally impractical to crack, while the randomness of the word combination makes it resistant to dictionary attacks. The words being unrelated to each other and to you is important — "football-united-arsenal-match" is much weaker than "lamp-Tuesday-brick-ocean" because the first set is guessable from your interests.

How to pick words randomly: open a book to a random page and point at a word. Roll a dice and use a wordlist. Use a passphrase generator. The key is that the selection is genuinely random, not words that feel random to you — human intuition of randomness is predictable in ways that matter for password security.

Method 2: Random generation

For passwords you don't need to memorise (which should be most of them — see below), a randomly generated string of characters is the strongest option available. Our password generator creates these in your browser, with no server involved.

What to set:

• Length: 16 minimum, 20+ preferred
• Include uppercase, lowercase, numbers, and symbols
• Exclude ambiguous characters (0/O, 1/l/I) if the password will be typed manually — less important if it's copied or autofilled

The obvious limitation: a randomly generated password like j4Kx#9mLpQ2@nW8v is impossible to memorise. This is fine, and intentional — you should not be memorising most of your passwords.

How many passwords do you actually need to memorise?

Three. Possibly four.

• Your device password / PIN — the one that unlocks your computer or phone
• Your password manager master password — the one password that unlocks all the others; this should be a strong passphrase
• Your primary email password — the one account your password manager and most other recovery routes point back to; worth memorising separately as a backup
• Optional: your work account password — if you're in an environment where you can't use a password manager

Everything else — gaming accounts, social media, shopping sites, forums, subscriptions — should be generated randomly and stored in your password manager. You never need to know what these passwords are; you just need to be able to open your password manager.

The single biggest mistake

Reusing passwords. If you use the same password on two sites and one of them gets breached, attackers will try that email and password on every other major site. This is called credential stuffing and it's automated — it takes seconds to try your credentials against hundreds of sites simultaneously.

Unique passwords for every account are the most important security practice available to a normal internet user. A password manager makes this trivially easy — you don't need to think of or remember unique passwords, you just generate them.

What about special character requirements?

Many sites require passwords to include uppercase, lowercase, numbers and symbols. These requirements help a little but are less important than length and uniqueness. A 20-character password with only lowercase letters is significantly stronger than an 8-character password with all four character types. If a site's password requirements restrict length (some cap at 12 or 16 characters), that's a red flag about their security practices — but work within their constraints and make it as long as they allow.

What to do right now

1. Install Bitwarden (free, open source) or another password manager of your choice
2. Create a strong master passphrase (four random unrelated words) that you memorise
3. Start saving passwords in the manager as you log into sites — don't try to migrate everything at once
4. When a site offers to update your password, generate a new random one and save it
5. Enable 2FA on your most important accounts — email, banking, social media