How to Make a Strong Password You Can Remember

Most password advice focuses on rules (one uppercase letter, one number, one symbol) that make passwords hard to remember without necessarily making them hard to crack. Current guidance, such as the recommendations published by NIST, puts the emphasis elsewhere: make passwords long, make them unique to each account, and do not force people into arbitrary complexity rules.

Why length beats complexity

Password crackers work by guessing at enormous speed. Every extra character multiplies the number of possibilities, far more than swapping an "a" for an "@" does. A long, random-ish phrase is much harder to brute-force than a short "complex" password like P@ss1!, even though the second one looks scarier.

The catch is predictability. Attackers do not only try every combination. They try common passwords, leaked passwords, and common patterns first: a capital letter at the start, a number or exclamation mark at the end, "Summer2026!", keyboard walks like qwerty123. A password that satisfies a complexity rule but follows a familiar pattern can still fall quickly. Likewise, a famous phrase from a song or book is not random, so it is not as strong as it looks.

Build a passphrase you can actually remember

For the few passwords you must type from memory, such as your password manager's master password or your device login, use a passphrase made of several unrelated words.

1. Pick four to six words at random. Truly random is best: use dice, a word list, or a generator rather than choosing words you like.
2. Do not use a quote, a lyric, or a phrase that has meaning to you.
3. Make a short, vivid mental picture linking the words so you can recall them in order.
4. Type it a few times over the first days, until it is automatic.

Something like "lantern ribbon gravel octopus" is easy to picture and long enough to be strong, but do not use that exact example, since examples in articles are the first thing people copy.

You should not remember most passwords

For everything else, the honest answer is that you should not be memorizing them. A password manager generates and stores a unique, random password for each site, so a breach at one service does not put your other accounts at risk. This matters because credential stuffing, where attackers try leaked email and password pairs on other sites, is one of the most common ways accounts are taken over. The only password you need to memorize is the one that unlocks the manager.

When you need a random password right now, our password generator creates one using your browser's cryptographically secure random number generator. Nothing is sent anywhere. It defaults to 16 characters, and a longer password is better when the site allows it.

How to decide

• Typed from memory (manager, device): a random passphrase of four to six words.
• Everything else: a unique, random password from a manager. Length of 16 or more characters is a sensible default.
• Important accounts (email, banking, your manager): add two-factor authentication. An authenticator app or a hardware security key is generally better than SMS codes.
• Shared accounts: use the manager's sharing features rather than sending passwords by chat or email.

Your email account deserves special care. Most "forgot password" links go there, so whoever controls it can often reset everything else.

Checking a password

Our password strength checker runs in your browser. Be aware of what it does: it scores a password on length (8 and 12 characters) and on character variety. It is a quick sanity check, not a full analysis, and it cannot know whether your password has appeared in a breach or is a well-known phrase. A long, random passphrase is better than anything a simple score can tell you. Do not paste a password you actively use into any site you do not trust.

If you need to protect a note or snippet rather than log into something, Encrypt Text encrypts text with a passphrase you choose, in your browser. It is only as strong as that passphrase, and you cannot recover the text if you forget it.

Common mistakes

• Reusing a password. One breach becomes many.
• Small variations on one base password. "Dog2025!" then "Dog2026!" is easy for attackers to guess.
• Personal details. Names, birthdays, pets, and addresses are easy to find or guess.
• Substitutions like "p@ssw0rd". Cracking tools try these routinely.
• Writing it in a plain notes app or a spreadsheet. A password manager is built for this and is safer.
• Skipping two-factor on email. It is the account that unlocks all the others.

Quick answers

How long should a password be?

For passwords you generate and store in a manager, 16 characters or more is a good habit. For a memorized passphrase, four to six random words. Longer is generally better, as long as the site accepts it.

Do I need to change my passwords regularly?

Current guidance generally advises against forced periodic changes. Change a password when you have reason to think it has been exposed, such as a breach notice or a suspicious login.

Are password managers safe?

They are widely recommended by security professionals, and the risk of one strong master password is usually far smaller than the risk of reusing weak passwords. Choose a reputable one, protect it with a strong passphrase and two-factor authentication, and keep recovery options current.

Is it okay to use a password generator website?

Only if you trust how it works. Ours runs locally and does not send the password anywhere, but even so, never reuse a generated password on more than one account.