How to Create a Strong Password You Can Actually Remember

Published 2026-10-24

Most people know they should use strong passwords. The trouble is that “strong” usually means something like q7#Lp!2vXz, and nobody can remember forty of those. The good news is that strength and memorability are not opposites. You just need to understand what actually makes a password hard to crack.

What attackers really do

When a website is breached, attackers usually get a database of scrambled (hashed) passwords. They then run guesses through the same scrambling process at enormous speed, often billions of guesses per second on graphics cards. They do not start with random strings. They start with lists of leaked passwords, dictionary words, names, dates and common patterns such as a capital letter at the start and “1!” at the end.

That is why Summer2024! is weak even though it has upper case, lower case, a number and a symbol. It follows exactly the pattern attackers try first.

Length beats complexity

Every extra character multiplies the number of possibilities. A random 8-character password using all character types has about 6 quadrillion combinations, which sounds huge but can be exhausted by a determined attacker. A random 16-character password has so many combinations that trying them all is not realistic with any current technology.

For passwords you have to type and remember, the practical lesson is simple: make them long.

Method 1: the random passphrase

Pick four to six words at random, not words that form a sentence you would naturally say. For example: orbit-lantern-cactus-violin-pepper. Five random words from a large list are far harder to crack than a short scramble, and you can picture them as a little scene to remember them.

The important word is random. “I love my dog Max” is not random, and phrases from songs, films and books appear in attackers’ lists. Roll dice against a word list, or use a generator, rather than choosing words yourself.

Method 2: let a password manager remember

For most accounts you never need to remember the password at all. A password manager stores a unique, fully random password for every site and fills it in for you. You only memorise one strong passphrase to unlock the manager.

Use our password generator to create those random passwords. Set the length to at least 16, keep all character types turned on unless a site rejects symbols, and paste the result straight into your manager.

Never reuse a password

Reuse is the single biggest risk for ordinary people. When one small website leaks its database, attackers try the same email and password on email providers, banks and shopping sites. This is called credential stuffing, and it works because so many people reuse passwords. A unique password for each account turns a leak into a minor nuisance instead of a disaster.

Add a second factor

Two-factor authentication (2FA) asks for something besides your password, usually a code from an app or a physical security key. Even if your password is stolen, the attacker cannot sign in without that second factor. Turn it on first for your email account, because email is how every other password gets reset.

A simple plan

  1. Create one long, random passphrase for your password manager and memorise it.
  2. Use the manager to generate a unique random password for every other account.
  3. Turn on 2FA for email, banking and social media.
  4. Change any password you know has been reused or leaked.

That is all it takes to be much safer than the average internet user, and none of it requires remembering dozens of strings of symbols.