Everyone knows they should use strong passwords. Almost nobody does — because the usual advice (“use 16 random characters!”) produces passwords nobody can remember, so people reuse one weak password everywhere. There’s a better way. This guide shows you how to create passwords that are genuinely hard to crack and possible to remember, plus the habits that keep all your accounts safe.
1. Why Most Passwords Get Cracked
Understanding the enemy makes the defense obvious. Passwords rarely get “guessed” by a person staring at a login screen — they get cracked by computers running through possibilities at incredible speed, or stolen in bulk from breached websites.
The three real threats
- Brute force: software tries every combination. A 6-character password falls in seconds; each extra character multiplies the attacker’s work enormously. Length is the single most important factor.
- Credential stuffing: criminals take email-password pairs leaked from one breached site and try them on every other site. This is why reusing passwords is the most dangerous habit — one breach becomes every account compromised.
- Dictionary and pattern attacks: attackers try common words, names, and patterns first. “Password123”, your pet’s name, your birth year, and keyboard walks like “qwerty” are cracked instantly no matter how you capitalize them.
The takeaway: your password needs to be long, unique per site, and unpredictable — and you need a system that makes that sustainable.
2. The Passphrase Method: Four Random Words
The best balance of strength and memorability for most people is a passphrase: four or more random words strung together. It’s easy to type, easy to remember, and brutally hard to crack.
How to build one
- Pick four random, unrelated words — the more unrelated, the better. Example: correct horse battery staple (the classic example) or your own like trombone pickle canyon lantern.
- Join them with a separator you like: spaces, dashes, or a number. trombone-pickle-canyon-lantern is fine.
- That’s it. Four random words give roughly the same cracking resistance as a 12-character random password, but you can actually remember them.
Rules for picking words
- Truly random beats clever. Don’t use a song lyric, a quote, or words that describe you — attackers try those. Flip through a book or use a dice-based word list if you want real randomness.
- Don’t use one word per account with a pattern like “trombone-pickle-amazon” and “trombone-pickle-gmail” — if one leaks, the pattern is obvious.
- Longer is always better: five or six words for your most important accounts (email, banking).
3. The Sentence Method: An Alternative You’ll Never Forget
If random words feel strange, turn a personal sentence into a password. It produces long, memorable passwords with natural complexity.
How it works
Take a sentence only you would write, then use the first letter of each word plus the numbers and punctuation. For example: “My grandmother’s mango pickle won 3 prizes in 1998!” becomes Mg’mpw3pi1998!. It’s 14 characters, has uppercase, lowercase, numbers, and symbols — and you can reconstruct it from the sentence anytime. Important: don’t use a famous quote or a sentence you’ve posted online. Invent something obscure and personal.
4. Use a Password Manager: The Real Solution
Here’s the honest truth: no human can remember 100 unique, strong passwords. That’s not a failure — it’s why password managers exist. A password manager generates and stores a unique random password for every site; you remember just one strong master passphrase.
Getting started
- Pick a reputable manager: Bitwarden (free and open-source), 1Password, or Apple’s built-in iCloud Keychain / Google’s Password Manager are all solid choices. Your browser’s built-in saver is better than nothing, but a dedicated manager works across all your devices and browsers.
- Secure it with a strong master passphrase (use the four-word method from section 2) and turn on two-factor authentication for the manager itself.
- Migrate gradually: as you log into sites over the next few weeks, let the manager generate a new random password for each one. Start with email, banking, and social media.
- Never store passwords in a notes app, a spreadsheet, or — worst of all — a document called “passwords” on your desktop.
5. Turn On Two-Factor Authentication Everywhere It Matters
Two-factor authentication (2FA) means logging in requires your password plus a second proof — usually a code from your phone. Even if someone steals your password, they can’t get in without that second factor. It’s the single highest-value security habit after using unique passwords.
Set it up right
- Enable 2FA on your email first — your email can reset almost every other account, so it’s the master key.
- Then enable it on banking, social media, and cloud storage.
- Prefer an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) over SMS codes — SIM-swap attacks can intercept text messages.
- Save your backup/recovery codes somewhere safe (printed and stored securely, or in your password manager). If you lose your phone without them, you can be locked out of your own accounts.
6. Password Habits You Should Never Have
Some practices feel safe but are genuinely dangerous. Eliminate these:
The never-do list
- Never reuse passwords across sites — especially not between low-value sites (forums, shopping) and high-value ones (email, banking).
- Never use personal info: names, birthdays, anniversaries, pet names, phone numbers, or addresses. Attackers harvest these from social media in minutes.
- Never share passwords over email, chat, or text — those messages live forever in inboxes and backups. If you must share access (like a family streaming account), use your password manager’s secure sharing feature.
- Don’t change passwords on a schedule unless there’s been a breach. Forced regular changes just make people pick weaker passwords (“Summer2024!” → “Autumn2024!”). Change a password when you suspect it’s compromised.
- Don’t trust “security questions” with real answers — your mother’s maiden name is findable. Treat them as extra passwords: answer with random words stored in your password manager.
7. What to Do After a Data Breach
Breaches happen constantly, including at huge companies. The question isn’t whether your data will leak — it’s whether you’re prepared when it does.
Check and respond
- Visit Have I Been Pwned and enter your email addresses to see which breaches exposed them.
- For every breached account, change the password immediately — and change it on every other site where you reused it.
- Turn on 2FA for those accounts if you haven’t already.
- Watch for phishing emails referencing the breach (“verify your account after the leak”) — criminals exploit breach news. Never click login links in such emails; go to the site directly.
8. Switch to Passkeys Where They’re Offered
Passwords — even good ones — are gradually being replaced by passkeys, a newer login method backed by Google, Apple, and Microsoft. A passkey is a cryptographic key pair stored securely on your phone: you log in with your fingerprint or face, and there’s nothing to phish, guess, or leak in a breach.
Start using them today
- When a site or app offers “Create a passkey” (Google, Apple ID, Microsoft, and many banks now do), accept it. Your phone stores the passkey in its secure hardware or synced keychain.
- Passkeys sync across your devices via iCloud Keychain or Google Password Manager, so you won’t be locked out if you lose one phone.
- You don’t need to abandon passwords overnight — use passkeys where offered and keep your password manager for everything else. Over time, the list of passwords you actually type will shrink to almost nothing.
Final Thoughts
The formula is simple: unique passphrase per site, stored in a password manager, protected by two-factor authentication. Start today with your email account — give it a fresh four-word passphrase and turn on 2FA. Then let your password manager handle the rest, one site at a time. Good password hygiene isn’t about having a perfect memory; it’s about having a good system.
