How to Make a Strong Password You Can Remember

The easiest way to make a strong password you can remember is to let a generator pick several random words and join them into a passphrase. Random words are long, which makes them hard to guess, and they form a picture in your head, which makes them easy to recall. Keep this kind of memorable password for the few logins you type yourself, and let a password manager hold random-character passwords for everything else.

This guide shows how to build a passphrase in about a minute, how many words to use, and a few memory tricks that make it stick.

How do you make a memorable passphrase in five steps?

You can do this with our password generator, which runs in your browser and never sends what it creates anywhere:

1. Open the generator and choose Passphrase.
2. Set the number of words. Start with seven.
3. Pick a separator, such as a hyphen or a space, that you find easy to type.
4. Tick Capitalize each word or Add a number at the end only if a site insists on capitals or digits.
5. Press Generate new until you get a set of words you can picture, then copy it into your password manager or write it down somewhere safe.

The words are chosen by your browser's secure random number generator. Pressing Generate new a few times is fine: you are choosing between random results, not making one up yourself, which keeps the result unpredictable.

Why are random words easier to remember than random characters?

A random password such as a string of letters, digits and symbols is compact and strong, but your memory has nothing to hold on to. Words are different. Each one is a single idea, and several odd ideas side by side can be turned into a little scene.

That is the whole trick behind a passphrase. It trades extra length for something your brain is good at: remembering images and stories. You type more characters, but you are not trying to memorise a meaningless jumble.

How many words should a passphrase have?

The generator shows a strength label and an estimate in bits, so you can see what each extra word adds. With its built-in word list, each word adds about 9.5 bits. In practice:

These labels are this tool's own scale and an estimate of how hard a random value is to guess, not a promise. A generator with a longer word list gives each word more strength. The simple rule holds either way: more random words means a stronger passphrase.

How long a password needs to be, and whether adding symbols helps more than adding length, is a separate question, covered in password length vs complexity.

What turns a passphrase weak again?

People often "improve" a generated passphrase and make it worse. Compare:

Only the last row adds real strength. If you want the passphrase to feel more personal, change the scene you imagine, not the words.

What memory tricks actually help?

• Build a scene. If the words were "maple", "orbit" and "canyon", picture a maple tree orbiting a canyon. These words are an illustration only; never use a passphrase from an article.
• Say it aloud. Hearing the words a few times helps them stick.
• Type it from memory for a week. Daily use does most of the work.
• Keep a private written copy until you are sure you know it, then store it somewhere safe or destroy it.

To check how long the result is, paste it into a character counter. A seven-word passphrase with separators is often more than 40 characters, which matters if a site sets a maximum length.

Where should you use a passphrase, and where not?

Use a passphrase for the few secrets you must type by hand: your computer or phone login, and the main password of your password manager. For every other account, let the manager create and store a long random password, so every site gets a different one and you never have to remember them.

Two more habits make a big difference. Never reuse a password on two sites, because one leak would expose both. And turn on two-step sign-in wherever it is offered.

If you would like more background on characters versus words, word count vs character count explains how both are counted. If a site refuses your new passphrase, read what to do when a site rejects your password.

FAQ

What is a good example of a strong password I can remember?

A good example is several random words chosen by a generator, such as seven words joined by hyphens. Do not copy an example from any website; generate your own.

Is a passphrase safer than a password?

A random passphrase and a random password can both be strong. The passphrase is easier to remember and type; the random password is shorter. Choose by where you will use it.

Can I make up my own passphrase?

It is better not to. People pick words that belong together, and that makes them easier to guess. Let a program choose.

Should I write my password down?

A written copy kept somewhere private, away from your desk and screen, is far better than a weak password. Many people keep one only until they have memorised it.

How often should I change it?

There is no need to change a strong, unique password on a timer. Change it if you think it has been exposed or shared.