How to Create Strong Passwords You Can Actually Remember

Every year the advice about passwords gets more elaborate, and every year the average person is no better off. Most people know they are supposed to use "strong" passwords, but the only practical guidance they've been given is "use upper and lower case, a number, and a symbol" — which produces passwords like Spring2026! that are easy to guess, easy to crack, and impossible to remember once you have fifteen of them. The actual rules are simpler and more useful.

What makes a password "strong" in the first place

Password strength is measured in entropy — the amount of randomness in the password, expressed in bits. A password's entropy tells you how many guesses an attacker would have to try, on average, to crack it. The relevant thresholds, against a modern offline attack that tries 10 billion guesses per second:

• Below 30 bits: crackable in seconds. This is where most human-chosen passwords live.
• 30–60 bits: crackable in minutes to days. Fine for low-stakes throwaway accounts, dangerous for anything you care about.
• 60–80 bits: crackable in years. Strong enough for most consumer accounts.
• 80+ bits: effectively uncrackable. Even nation-state attackers with dedicated hardware would need longer than the age of the universe.

To put that in concrete terms, an 8-character password made of upper, lower, digits, and symbols has about 48 bits of entropy. A 16-character random password from the same character set has about 96 bits — not twice as strong, 2⁴⁸ times as strong. Length is not just better than complexity; it is exponentially better. This is the single most important fact about password strength, and almost nobody acts on it.

You can check any password's entropy with a password strength checker. The result will surprise you — most "clever" passwords score far worse than their creators expect, because the cleverness is exactly what an attacker's dictionary knows about.

The two strategies that actually work

There are only two practical ways to get a strong, unique password for every account:

Strategy 1: A password manager

A password manager (1Password, Bitwarden, KeePass, Apple Passwords, the one built into Chrome) generates a random password for every account, stores it encrypted, and fills it in for you when you log in. The only password you need to remember is the one that unlocks the manager itself.

This is the right answer for 95% of people. It is:

• Strong — every password is randomly generated at the maximum length the site allows.
• Unique — one breach doesn't compromise your other accounts.
• Convenient — the manager fills passwords for you; you type the master password once a day, maybe.
• Resistant to phishing — most password managers only autofill on the exact domain they saved, so a phishing site gets nothing.

The objection is "what if the manager gets hacked?" A reputable password manager stores your vault encrypted with a key derived from your master password. The server only ever sees encrypted data. Even if the company is breached, the attackers get ciphertext that is essentially uncrackable without your master password.

If you do nothing else from this article, get a password manager and start using it.

Strategy 2: Memorable passphrases

For the small number of passwords you must remember by heart (the password manager's master password, your device login, your full-disk encryption passphrase), use a passphrase: a sequence of random, unrelated words, with maybe a number or symbol sprinkled in. The idea is from a famous xkcd comic and it is correct: the entropy of a four-word passphrase from a 7776-word list (the EFF's recommended diceware wordlist) is about 51 bits — stronger than a "complex" 8-character password, and far easier to remember.

Examples:

correct-horse-battery-staple
muffler-coaster-jovial-zebra-42
sundial-9-quartz-microscope-bagel

Three or four words is enough for an account that doesn't need to be ultra-secure. Five or six words for the master password that protects your entire password vault. Use a password generator that supports passphrase mode, or pick words by rolling dice against the EFF wordlist for true randomness.

The advantage: you can actually remember it. The disadvantage: you've now created a password that you reuse mentally across sites if you aren't careful, which defeats the "unique" requirement. Use passphrases only for the few passwords you must type by hand; let the manager handle the rest.

What NOT to do

The list of "bad password advice that is still everywhere":

1. Substituting numbers for letters

P@ssw0rd
H4ck3r
Tr0ub4dor

Every password cracker knows these substitutions. They add maybe 2 bits of entropy. The cost in memorability is much higher than the benefit in strength. P@ssw0rd is in the top 100 leaked passwords, every year, because the substitution buys you nothing.

2. Adding the year

Spring2026
Company2026
MyName2026

Every attacker tries the current year first, then the previous year, then two years back. Adding 2026 to a base word adds about 4 bits of entropy at most. The 20 minutes it takes to update it every January also makes this strategy actively annoying.

3. Using personal information

Your pet's name, your kid's birthday, your favorite sports team — all of this is in your social media profiles, in leaked databases, and in attacker wordlists. Even if the attacker has to combine two pieces of information ("what's her dog's name and what year did she graduate?"), the search space is still small.

4. Reusing passwords across sites

The single biggest cause of mass account compromise. When a site you have an account on is breached and the password database leaks (which happens constantly), attackers immediately try that email + password combination on every other major site. If you used the same password on your email and on a small forum, the attacker now has your email. The fix: unique passwords everywhere, which a password manager makes trivial.

5. Writing them down on a sticky note

Surprisingly, this is fine for low-stakes accounts if you trust your physical environment. A sticky note on a monitor at the office is bad (visitors, cleaning staff, the occasional photo for a remote call). A notebook in a locked desk drawer at home is fine. A password manager in your pocket is better than both. The point is that "writing it down" is not the security failure people think it is — the failure is reusing the written password across sites.

The minimum viable password setup

If you do nothing else, do this:

1. Install a password manager. Bitwarden is free and open source. 1Password is excellent and cheap. Apple Passwords is built into your iPhone. The built-in Chrome / Firefox / Edge password manager is fine if you only use one browser and you turn on sync.
2. Set a strong master password using a passphrase — five or six random words, something you can type from memory. Write it down once, store the paper somewhere safe, and don't look at it again.
3. Turn on two-factor authentication on the master password account (use a TOTP authenticator, not SMS). This is the one account you really cannot afford to lose.
4. Replace your most important passwords first — email, banking, password manager, anything with payment info. Let the manager generate the new ones.
5. Over the next few months, replace the rest as you log into each site. Most managers have a "password health" report that lists reused and weak passwords; work down that list over time.

This takes an afternoon to set up and saves you years of low-grade dread. The next time a major breach hits the news and you get the "your email was found" notification, you will check the breach, see that the password is unique to that one site, change it, and move on — instead of spending a weekend resetting every account you have ever created.

How to check a password before you use it

Before adopting a new password, run it through a password strength checker to see its entropy and crack time. Two useful checks:

• Entropy above 60 bits for any account that holds personal data.
• No known patterns — keyboard sequences (qwerty), repeated characters (aaaa), all-numeric, all-lowercase. The checker will flag all of these.

Pair the strength check with a password generator that uses your browser's secure random source (not Math.random, which is not cryptographically secure). Together they replace the guesswork with a clear, defensible answer.

Strong passwords are not about clever tricks. They are about length, randomness, and uniqueness — three properties that a password manager gives you automatically, and a passphrase gives you when you must remember one. The rest is just letting go of the bad advice you've been given for the last 20 years.