How to Create a Strong Password You'll Actually Remember
The password you can actually remember and the password that's actually strong don't have to be different things.
Most advice about passwords optimizes for the wrong thing. It tells you to bolt on a capital letter, a number, and a symbol, and call it secure — which is how the world ended up with millions of accounts protected by "Summer2024!" But strong and memorable aren't opposites. You just need a method that treats them as the same problem.
Why "complex" passwords keep failing
A password like Tr0ub4dor&3 looks intimidating, but it fails in a boring, predictable way: nobody can hold it in their head. So it gets written on a sticky note, saved in a browser you forget you're logged into on a shared computer, or reused across a dozen accounts because generating a new one of these every time feels like a chore. The password itself might resist a brute-force guess, but the habits it forces on you don't.
There's also a mechanical problem. Swapping letters for symbols — a to @, o to 0 — feels clever, but it's a pattern, and attackers' cracking tools have had that pattern built in for years. A short password dressed up with substitutions is often barely stronger than the same password in plain letters. Complexity rules were meant to make passwords harder to guess; in practice they mostly make them harder to type correctly and easier to forget.
The passphrase method (and when to use random characters instead)
The fix that's held up well is deceptively simple: string together several random, unrelated words. Something like lantern-gravel-otter-budget is longer than almost any password you'd type manually, easy to say out loud, easy to recall a week later, and — because the words are unrelated and chosen at random rather than plucked from a sentence you like — genuinely hard to guess. Four or five words is a solid target for anything you'll type from memory regularly, like a device passcode or your password manager's master password.
A passphrase isn't the right tool everywhere, though. Plenty of accounts don't need to be memorized at all — they just need to be strong and unique, then stored somewhere you can retrieve them, like a password manager. For those, a fully random string of upper- and lowercase letters, numbers, and symbols is the better choice, because you're optimizing purely for unpredictability with no memorability tax. Typing it out by hand isn't the goal; generating it once and never seeing it again is. That's exactly the case our Password Generator is built for — set a length, pick which character types to allow, and get a result with none of the patterns a human tends to fall into when asked to "just make something up."
What "entropy" actually means, in plain terms
Entropy is just a way of measuring how many guesses it would take to land on your password by chance. Every additional character multiplies the number of possible combinations, which is why length matters so much more than most people expect. A four-word passphrase drawn from a large word list has roughly as many possible combinations as a random string well over a dozen characters long — because you're not choosing from 26 letters at each position, you're choosing from thousands of words, and stacking several of those choices together.
This is also why forced complexity rules can be misleading. Adding one mandatory symbol to a short password barely moves the needle, because you're only expanding the character set at a single position. Adding four more random characters — or one more random word — usually does far more, because it expands the space of possibilities at every position that follows. If you only take one thing from this, take this: when in doubt, make it longer, not more convoluted.
The modern, low-effort standard
Security guidance has shifted meaningfully over the past several years, and it's shifted toward less busywork, not more. Forced password resets every 90 days are on their way out, because they mostly train people to make small, predictable edits to a password they already know rather than adopting a genuinely new one. Mandatory symbol-and-number rules are being relaxed for the same reason — they push people toward patterns instead of randomness. What's replaced them is a much simpler standard: make it long, make it unique to that one account, and only change it if you have a real reason to believe it's been exposed. (We go deeper on which old rules to drop in Password Rules That Actually Matter, if you want the full breakdown.)
In practice, that means a passphrase for the handful of passwords you need to type from memory, a generated random string for everything else, and a password manager to hold the ones you're not memorizing. That combination covers essentially every account you own without asking you to remember more than four or five things, total.
Once your passwords are actually locked down
A strong login is only one piece of keeping your accounts and information under your control. If you've ever handed a guest a scrap of paper with your WiFi password scrawled on it, a WiFi QR Code Generator replaces that with a code they scan and connect instantly, no typing and no password left lying around. If you find yourself repeating your phone number and email out loud at every event, a vCard QR Code Generator shares your contact details cleanly, with zero risk of a typo turning into a wrong number saved in someone's phone. And for anything you want people to reach reliably long-term — account recovery instructions, a support contact, a reference link that might move someday — a Permanent QR Code Generator keeps working even if the destination changes, so the code itself never goes stale.
None of this requires new habits, just slightly better ones. Pick a passphrase for what you need to remember, generate the rest, and stop reusing the same tired password out of sheer fatigue.
Frequently asked questions
- Is a passphrase actually more secure than a random string of characters?
- For most people, yes — because you'll actually use it. A four- or five-word passphrase can have more raw entropy than a short mangled string like Tr0ub4dor!, and you'll type it correctly the first time instead of guessing which letters you swapped for symbols six months ago.
- How long should my password be?
- Length is the single biggest factor in password strength. Aim for at least 12-16 characters for everyday accounts, and 20 or more for anything sensitive, like your email or password manager's master password. A longer password beats a shorter "complex" one almost every time.
- Do I still need to change my passwords every 90 days?
- No — current guidance from security experts has moved away from forced periodic resets, since they mostly just push people toward small predictable tweaks (Password1, Password2). A long, unique password only needs to change if it's actually been exposed in a breach.
- What's the easiest way to get a truly random password when a passphrase won't work?
- Use a tool built for it rather than typing something out yourself — our Password Generator uses your browser's cryptographically secure random number generator, so the result is unpredictable in a way a human-picked string never quite is.