How to create strong passwords you can actually remember
Weak, reused passwords are the most common way ordinary accounts get broken into. Here is a simple system that fixes it for good.
You do not need to be a security expert to have strong passwords. You need one good habit and, ideally, one free tool. This article covers both.
Why reused passwords are so dangerous
Companies get hacked all the time, and when they do, lists of email addresses and passwords are stolen and traded online. Attackers then try those username-and-password pairs on hundreds of other sites — your email, your bank, your shopping accounts. This is called credential stuffing, and it works because most people reuse the same password everywhere.
Even a very strong password is weak if you use it in more than one place. One breach then unlocks your whole life.
Length beats complexity
Forget tricks like P@ssw0rd! — computers guess those patterns easily. What actually makes a password hard to crack is length and unpredictability. A reliable method is the passphrase: four or more random, unrelated words strung together, such as correct-battery-otter-village-7. Long, random, and easy to picture in your head.
Let a password manager do the hard part
Remembering a unique passphrase for 80 accounts is impossible — and that is exactly what a password manager is for. It is a secure, encrypted vault that creates and stores a different strong password for every account. You remember one master password; it remembers the rest and fills them in only on the correct website, which also protects you from fake phishing sites.
- It generates long random passwords instantly
- It works across your phone, laptop, and browser
- It can warn you when a saved password appears in a known breach
See our resources directory for well-regarded options. The manager built into your phone or browser is also far better than reusing passwords.
Which accounts to fix first
- Your main email. Whoever controls your email can reset almost every other account. Protect it first.
- Banking and payment apps.
- Government, health, and phone-carrier accounts.
- Shopping accounts with a saved card — then the rest over time.
Check if you have already been exposed
Enter your email address at haveibeenpwned.com — a free, trusted service that tells you which known data breaches include your details. If a password was exposed, change it everywhere you used it, and turn on two-factor authentication.