How to create strong passwords you can actually remember

Technology · 6 min read

The classic advice, a jumble like "xK9#mP2$", gives you a password that is hard for you to remember and not as hard for a computer to guess as you would hope. Modern guidance is friendlier: long, unique and easy for you, hard for attackers. Here is how to get there.

What makes a password strong

Length is the main ingredient. Attackers use software that tries billions of guesses, and each extra character multiplies the work. A password also needs to be unpredictable, meaning not a name, birthday, phone number, "password123" or a keyboard pattern like "qwerty". Finally, it must be unique, because if you reuse one and any site leaks it, criminals try it everywhere else, a trick known as credential stuffing.

Use a passphrase instead of a password

A passphrase is several random words strung together, such as copper-mango-ladder-monsoon. It is long, which makes it strong, but pictures are easier to remember than symbols. The words must be genuinely random and unconnected. A famous quote, song lyric or "ilovemydog" is much weaker, because those are exactly what attackers try.

• Choose four to six unrelated words, ideally generated by a dice method or a password manager, rather than ones you pick yourself.
• Separate them with a symbol or number to make a rule easy to remember: Copper7mango7ladder7monsoon.
• Make a vivid mental story linking the words, such as a copper ladder leaning on a giant mango during the monsoon. Silly images stick.

A quick comparison

Example	Strength	Why
Rahul1995	Weak	Name and birth year, easily guessed
P@ssw0rd!	Weak	Common substitutions are in every cracking list
Tr0ub4dor&3	Moderate	Short, and hard for humans yet predictable for software
copper mango ladder monsoon	Strong	Long, random words, easy to picture

Please do not use any of these exact examples; publishing a password makes it unsafe.

Let a password manager do the heavy lifting

You may have hundreds of accounts, and nobody can memorise hundreds of strong, unique passphrases. A password manager stores them in an encrypted vault, fills them in for you and generates random ones on demand. Well-known options include Bitwarden, 1Password and KeePass, and Google and Apple also offer built-in managers in their browsers and phones. You then only need to remember one strong master passphrase, plus perhaps your email and phone lock.

Priority list: make the master password for your manager and your main email password the strongest, because email can reset almost every other account. Banking and UPI-linked apps come next.

Turn on two-step verification

Two-factor authentication means a stolen password alone is not enough. Where possible, use an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy, or a hardware security key, rather than SMS codes, which can be intercepted through SIM-swap fraud. Enable it first for email, banking, social media and cloud storage. Save the backup codes somewhere safe, offline, in case you lose your phone.

Step by step: overhaul your accounts in an afternoon

1. Pick a password manager and install it on your phone and computer.
2. Create a long master passphrase of five or six random words, and write it on paper to keep somewhere safe at home for the first few weeks.
3. Start with email. Change that password, then turn on two-step verification.
4. Change your top ten accounts: banking, shopping, social media, work, cloud storage, mobile wallets. Let the manager generate random 16-plus-character passwords.
5. Check for leaks. Services like Have I Been Pwned show if your email appeared in a known breach; change any affected passwords.
6. Update the rest gradually, changing one old password each time you log in to an account.

Habits to avoid

• Reusing one password, even with small variations like adding "1" at the end.
• Sharing passwords over WhatsApp or email; if you must share, use the sharing feature of a manager.
• Typing passwords on shared computers or public Wi-Fi without protection.
• Answering security questions truthfully. Facts like your mother's maiden name can be found online, so treat the answers as extra passwords and store them in your manager.
• Entering your password on a page you reached from an unexpected link. Phishing fakes look convincing, so type the web address yourself or use the official app.

Is it fine to write passwords down?

For most home users, a paper notebook kept in a safe place at home is actually better than reusing the same password everywhere, because a burglar is a much smaller threat than a global data leak. It is not ideal, but it beats weak, repeated passwords. A password manager remains the better long-term answer.

When you should change a password

You no longer need to change strong passwords every 90 days as an old rule suggested. Change them when a service reports a breach, when you notice suspicious activity, after using a shared computer, or if you suspect a phishing attempt. If you think a financial account is compromised, contact the bank immediately and report cyber fraud through your country's official channels, such as the cybercrime portal in India.

Final thoughts

Use long random passphrases, store everything else in a password manager, keep every account unique and add two-step verification on the important ones. You end up remembering just one or two strong phrases, while everything else is protected without effort.