How to create a strong password you can remember

Most people should try to remember only one or two passwords, and both should be random word passphrases rather than clever strings. Every technique for making a character password memorable, substituting numbers for letters, taking the first letter of a sentence, adding a year, produces exactly the patterns cracking software tries first.

Why the usual advice fails

Three methods get repeated everywhere. All three are weaker than they appear.

Letter substitution. Turning sunshine into $un5h1n3 feels like a transformation. To a cracking tool it is not one: substitution rules are in the default configuration of every serious toolkit. The word is the weakness, and disguising it adds under a bit of real strength.

The sentence-initials trick. “My first car was a blue Honda in 2009” becomes Mfcwabhi09. Better than a dictionary word, but the output is still short, and the input sentence comes from a narrow pool of autobiographical facts, the kind of facts that appear on social media.

A base password with a site suffix. Gmail_Winter24, Amazon_Winter24. The intent is good, a different password per site, but one leak reveals the entire system, and attackers apply exactly this rule automatically.

The common failure is that a human chose the structure. Dictionary attacks do not guess characters; they guess the way people think.

What works: random words

Four to six words, chosen by a machine, joined by a separator:

trout-canyon-mellow-drift-basin

Each word drawn at random from the 1,296-word EFF list adds 10.34 bits of entropy. Five words is 51.7 bits; six is 62. That comfortably exceeds what most people produce by hand, and it is genuinely easier to hold in memory, because your brain stores five familiar objects far better than ten arbitrary symbols.

The critical condition: a machine has to pick the words. A phrase you compose yourself follows grammar and association, which collapses the search space enormously. Generate one here; it runs entirely in your browser.

How to actually memorise it

Recall practice, not repetition. Reading a password twenty times in a row does almost nothing; retrieving it from memory a few times across a day does a great deal.

1. Generate the passphrase and write it on paper.
2. Type it from memory. Look at the paper only when you stall.
3. Repeat after ten minutes, after an hour, and at the end of the day.
4. Repeat once the next day, then once three days later.
5. Keep the paper somewhere physically safe for the first month.

Most people are solid after two days. Build a mental image while you learn: for trout-canyon-mellow-drift-basin, picture a trout drifting mellowly through a canyon basin. Absurd images stick better than sensible ones, which is why the technique works.

Only remember what you must

This is the part that changes the problem. You do not need to remember a hundred passwords, and any strategy that tries will fail: it ends in a system, and systems are guessable.

You need to remember one: the master password protecting your password manager. Every other password should be random, unique, and handled by software. Sixteen random characters for each of them, none of which ever enters your head.

There are two ways to get there:

• A vaulted manager stores encrypted copies and fills them in for you.
• A deterministic manager recreates each password on demand from your Master Key and the site name instead of storing generated credentials.

The second option is worth knowing about here because it changes what “remembering” means. Your Master Key plus the site’s name reproduces the password every time on supported devices, with no vault of generated credentials to sync. Here is how that works.

The one or two you type by hand

A small number of passwords cannot live behind software, because you need them before the software is available:

• Your master password or private phrase.
• Your device login, typed at a cold boot.
• Sometimes a work account on a locked-down machine.

Give each of these a six-word passphrase. That is the entire memory burden, and it is achievable.

A quick checklist

• Six random words for your master password. Machine-generated, not composed.
• Sixteen random characters everywhere else, handled by software.
• Never reuse the master password anywhere, for anything.
• Write it down and store the paper securely: forgetting is a far more likely threat than burglary.
• Two-factor authentication on your email account first.
• Test what you already use against a pattern-aware checker rather than a character-class meter.

In short

Strong and memorable are only compatible in one form: several random words. Everything else that claims to be memorable is a pattern, and patterns are what attackers guess. Remember one passphrase properly, generate everything else, and stop asking your memory to do a computer’s job.