We’ve all been there: the site demands 12 characters, a capital, a number, a symbol and your firstborn — so you create “Summer2024!” and use it everywhere. Then you forget which variation you used where, and end up resetting passwords weekly. There is a better way. Here’s how to create a strong password you can actually remember, using methods security experts genuinely recommend (not the outdated advice your IT department gave you in 2010).
Strong password basics: forget everything you were taught
The old advice — random strings like “Tr0ub4dor&3”, changed every 90 days — has been officially retired. Even the US National Institute of Standards and Technology (NIST), which wrote those rules, now says they were counterproductive: they produce passwords that are hard for humans to remember but easy for computers to crack, and forced changes just make people add “1”, “2”, “3” to the same base. The UK’s National Cyber Security Centre (NCSC) agrees. The modern advice is simpler and better.
The passphrase method: strong AND memorable
The NCSC’s headline recommendation: use three random words. Something like “coffeetabledinosaur” or “redbicyclethunder”. Here’s why it works:
- Length beats complexity. A 20-character passphrase of ordinary words has vastly more combinations than an 8-character jumble of symbols. Attackers crack short complex passwords easily; long passphrases resist brute force for centuries.
- Humans remember words. “correcthorsebatterystaple” (the famous example) sticks in your head; “J7#kP2!x” doesn’t.
- They’re fast to type. No hunting for the & symbol on a phone keyboard.
Make yours personal but not guessable: combine unrelated words, maybe with a number or symbol thrown in somewhere memorable (“teapot47dinosaur!”). Avoid anything connected to you — pet names, birthdays, football teams, children’s names are the first things attackers try, and they’re often visible on your social media. The random-word generator in most password managers creates these for you.
The real answer: use a password manager
Here’s what security professionals actually do: they don’t remember passwords at all. A password manager — Bitwarden (free, excellent), Apple’s iCloud Keychain (free, built in), Google Password Manager (free, built in), or 1Password (paid, polished) — generates a unique random 20-character password for every site and remembers them all. You remember one strong master passphrase; it handles the rest.
This solves the actual problem. The danger was never that your password was too simple — it’s that you reused it. When (not if) some website gets breached, attackers try your email+password on banks, email and shopping sites automatically (“credential stuffing”). Unique passwords per site make breaches someone else’s problem. A password manager makes unique passwords effortless — it even fills them in for you.
If you take one thing from this article: install Bitwarden today. It’s free, takes ten minutes to set up, and it’s the single biggest security upgrade most people can make.
What about the passwords you must remember?
You’ll still need a few memorised: your password manager’s master password, your phone PIN, your computer login, maybe your email. For these, use the three-random-words method, and make the master passphrase the strongest — it’s the key to everything. Write it down on paper and keep it somewhere safe at home (yes, the NCSC says this is fine — a burglar stealing a piece of paper from your house is far less likely than a remote attacker guessing your password).
Enable two-factor authentication everywhere important
A strong password is half the battle; two-factor authentication is the other half. Even if someone steals your password, they can’t log in without your phone. Turn it on for email, banking, social media and your password manager itself. Use an authenticator app (Google Authenticator, Authy, or the built-in one in Bitwarden/1Password) rather than SMS codes where possible — SIM-swap attacks can intercept texts.
Password mistakes to stop making today
- Reusing passwords across sites. The number one sin. One breach becomes every account breached.
- Using personal information. Names, dates, places, teams — all guessable, often public.
- “Password123”, “qwerty”, “letmein”. Still among the most common passwords in every breach database. Attackers try these first, automatically.
- Sharing via email or text. If you must share a password (a family Netflix login), say it in person or use your password manager’s sharing feature.
- Security questions with honest answers. “Mother’s maiden name” is public record. Treat security questions as extra passwords — answer with random words stored in your password manager.
- Changing passwords on a schedule. Only change a password if there’s reason to (a breach, a shared password, you typed it into a phishing site). Scheduled changes just produce weaker passwords.
What to do right now (15 minutes)
- Install Bitwarden (or enable iCloud Keychain / Google Password Manager).
- Create a strong master passphrase using three random words.
- Change your email password to a generated unique one — email is the master key to everything (password resets go there).
- Change your banking passwords next, then work through important sites over the coming days. The manager’s import tools help.
- Turn on two-factor authentication for email and banking.
The bottom line
Passkeys: the beginning of the end for passwords
There’s good news on the horizon: the industry is slowly replacing passwords with passkeys — cryptographic logins tied to your device’s biometrics (fingerprint or face). You verify with your finger, nothing is typed or phishable, and there’s nothing to remember or reuse. Apple, Google and Microsoft all support passkeys now, and a growing list of major sites (Google, Amazon, eBay, PayPal) let you sign in with them. When a site offers “sign in with a passkey”, take it — it’s both easier and far more secure than any password. Passwords won’t vanish overnight, but over the next few years expect your password manager to gradually become a passkey manager. The future of “a password you can remember” is not needing one at all.
Your email password matters most of all — pair a strong passphrase with two-factor authentication for the complete setup.
Strong and memorable isn’t a contradiction: three random words give you a password that’s both. But the real solution is remembering fewer passwords, not better ones — a password manager plus unique generated passwords plus two-factor authentication is what security experts actually use, and it’s free. Stop reusing “Summer2024!” everywhere. Future you, reading about the latest data breach without a flicker of worry, will be glad you spent these fifteen minutes.
