Everyone knows passwords should be strong. Almost nobody enjoys creating or remembering them. So people compromise: the same password everywhere, a pet's name with a "1" at the end, a sticky note under the keyboard. The result is predictable — account takeovers that could have been prevented.
The good news is that memorability and strength aren't actually enemies. With the right method, you can have passwords that resist automated attacks and that you can recall without writing them down. Here's how password strength really works, and a practical system for building passwords you'll actually remember.
What "strong" actually means
A password's strength comes down to one thing: how many guesses an attacker needs, on average, to find it. Attackers don't sit typing guesses by hand — they run software that tries millions or billions of combinations per second, starting with the most likely ones: dictionary words, common patterns, and passwords leaked in previous breaches.
Two factors decide how long your password survives that:
- Length — the single most important factor. Each extra character multiplies the guessing space. A 16-character password isn't twice as strong as an 8-character one; it's astronomically stronger.
- Unpredictability — random or unexpected combinations force attackers into slow brute-force guessing instead of fast smart guessing.
To put numbers on it: a truly random 8-character password (letters, numbers, symbols) takes modern hardware hours to days to crack; a random 12-character one takes centuries; 16 characters is effectively forever. But "Password1!" — 9 characters with a capital, a number, and a symbol — falls in seconds, because it follows one of the most common human patterns in existence. Complexity rules ("must contain a symbol") help far less than most people think; length helps far more.
The passphrase method: strong and memorable
The most practical approach for passwords you must remember is the passphrase: several random words strung together. Four or five unrelated words create enormous guessing space while remaining visualisable and typable.
Example: correct horse battery staple — the famous illustration — has roughly the same guessing resistance as a much shorter random string, but you can actually picture it and type it. To build your own:
- Pick 4–5 genuinely random words. Open a book at random pages and point, use dice, or let a password generator produce word-based passwords. Don't pick a meaningful phrase — "ilovemydogmax" is a sentence, and sentences are guessable.
- Add one personal twist. Capitalise one word unexpectedly, swap a letter for a number in one place, or add a symbol between two words:
correct-HORSE-battery-7staple. The twist defeats dictionary attacks that try plain word lists. - Make each important account's passphrase different. This is the critical part (more below).
- Type it a dozen times. Muscle memory forms fast — after a day or two of logins, you won't need to think about it.
A passphrase like trumpet-PILLOW-4cactus-orbit is around 28 characters, resists brute force for geological timescales, and is far easier to remember than J7#kL9!qZ2.
The one rule that matters most: never reuse
If you take one thing from this article, take this: using the same password on multiple sites is the single most dangerous password habit — worse than a weak password used once.
Here's why: breaches happen constantly, and stolen username/password pairs are automatically tried against thousands of other sites within hours ("credential stuffing"). Your bank's security is irrelevant if the forum you joined in 2019 stored your shared password in plain text. The forum gets breached; the attackers try the same password on your email; your email gives them password resets for everything else. The whole chain collapses because of one reused password.
This means you need unique passwords for every important account — especially email (the master key to all your resets), banking, and work accounts. For accounts you must memorise, unique passphrases work. For everything else, there's a better tool (below).
Use a password manager for the rest
No human can memorise 80 unique 16-character passwords, and you shouldn't try. A password manager generates, stores, and fills in long random passwords for every site; you remember one strong master passphrase to unlock it.
This is the setup security professionals actually use: a memorised passphrase for the manager itself, plus your email and maybe your primary device — and random 20-character strings for everything else, which you never need to see or remember. If a site gets breached, only that site's random password is exposed, and it's useless everywhere else.
Add two-factor authentication (2FA) on your email, bank, and password manager. Even if someone steals a password, the second factor (an authenticator app code, not SMS if you can avoid it) stops them.
Mistakes that undo strong passwords
- Reusing passwords across sites (see above — the big one).
- Predictable substitutions: "P@ssw0rd" isn't clever; attackers try every common substitution automatically.
- Personal information: names, birthdays, addresses, and pet names are guessable and often public on social media.
- Keyboard patterns: "qwerty", "1q2w3e4r", "abcd1234" are among the first guesses in every attack dictionary.
- Sharing passwords over chat or email — use your password manager's sharing feature or a one-time secret link instead.
- Never changing a password after a breach notification. If a service tells you to reset, do it immediately, and check whether you reused that password anywhere else.
Frequently asked questions
How long should my password be?
Aim for at least 12 characters for anything generated, and 4–5 words (20+ characters) for passphrases you memorise. Longer is always better — there's no downside to extra length except typing time, which muscle memory solves.
Are password generators safe to use?
Yes, provided the generation happens locally in your browser (so the password never travels over the network) and uses a proper random source. A reputable password generator running entirely in your browser is fine. Never use a generator on a shady site, and never let anyone "generate a password for you" over chat or email.
Should I change my passwords regularly?
Forced periodic changes are no longer recommended by most security guidance — they push people toward weak, predictable tweaks ("Summer2026!" → "Autumn2026!"). Change a password when there's a reason: a breach notification, suspected compromise, or sharing it with someone who no longer needs it. A strong, unique, unshared password doesn't expire.
Is writing passwords down really that bad?
A notebook kept at home is far less risky than reusing passwords — remote attackers can't read your desk drawer. But it's fragile (loss, theft, prying eyes) and doesn't scale. A password manager is the better version of the same idea, with encryption, backups, and autofill.