How to Create a Strong Password You Can Actually Remember

Most password advice is built on an assumption that stopped being true around 2010: that an attacker is guessing passwords one at a time, by hand. Nobody does that anymore. Modern cracking runs on GPUs trying billions of candidates per second against a stolen database of password hashes.

That change flips the standard advice on its head.

Length beats complexity

The two things people are told to do — add symbols, add capitals — both increase the search space by a small factor. Adding a character increases it by a much larger one.

Do the arithmetic. A password using 62 possible characters (letters, digits) gains about 5.95 bits of entropy per character added. Turning a lowercase-only password into mixed case gains about one bit per character. Adding two characters is worth more than every complexity rule combined.

This is why Tr0ub4dor&3 — which looks strong and is annoying to type — is weaker than correct-horse-battery-staple, a passphrase of ordinary words. The passphrase is longer, and length is what costs an attacker time.

Concretely: a random 16-character password drawn from 62 characters carries roughly 95 bits of entropy. A four-word passphrase drawn from a 7,776-word list carries about 52 bits. Both are far beyond what a stolen-hash attack can reach with current hardware — the first is stronger, the second is far easier to remember. Either is enormously better than Summer2026!.

What actually makes a password weak

It is in a breach database. This is the dominant risk, and it is why the modern recommendation from NIST (SP 800-63B) is to check new passwords against known-breached lists rather than enforce complexity rules. A password that has appeared in a leak is compromised regardless of how long or random it looks.

It is reused. Credential stuffing — taking a username and password from one breach and trying them on every other service — is the single most effective attack against ordinary users. One reused password turns one breach into twenty.

It is a pattern. Password1!, Qwerty123, Company2026, keyboard walks, and leetspeak substitutions of dictionary words are all in every cracking wordlist. Substituting a→@ and o→0 is anticipated by the tools and adds almost nothing.

It is short. Under about 12 characters, even a random password starts to be reachable. Length is the only lever that scales well.

The advice that is out of date

“Change your password every 90 days.” NIST dropped this recommendation. Forced rotation produces predictable patterns — Fall2026, Fall2026!, Fall2026!! — and measurably weakens passwords rather than strengthening them. Change a password when there is a reason: a breach notice, a shared credential, a suspicion.

“Use a different password everywhere, but remember them all.” This is not a solvable problem by memory. It is a solved problem by tooling.

“Never write it down.” Writing a password on paper kept in a locked drawer is a reasonable trade for most people. Writing it in a plaintext file on a synced desktop is not. The threat models are completely different.

What to actually do

1. Use a password manager. This is the single highest-value change available. It generates genuinely random passwords, stores them encrypted, and removes the need to remember anything but one master passphrase. Every password becomes unique and long, which is what you want.
2. Make the master passphrase a passphrase. Four to six random words. Long, typed often enough to be remembered, and not derived from anything about you.
3. Turn on two-factor authentication. A password alone is a single point of failure. TOTP apps or hardware keys are meaningfully better than SMS, which is better than nothing.
4. Check for breaches. If a service you use has been leaked, change that password — and anywhere you reused it.

Generating one safely

For a password you are going to paste into a manager, a generator is the right tool. The password generator creates random strings with configurable length and character set, and runs entirely in your browser — the generated value is never transmitted anywhere.

That last point is not decoration. A password generator that sends the result to a server has handed your new credential to whoever runs it. You have no way to know whether it was logged, and the entire point of the tool is to produce a secret. This is the same structural argument as in are online file converters safe, applied to the one piece of data where it matters most.

A quick way to check any generator: open your browser’s network tab, generate a password, and look for a request carrying it. A browser-side generator produces none.

Frequently asked questions

How long should a password be? At least 12 characters for anything you type by hand, 16 or more for anything a manager stores. Length is the property that matters most, so err long.

Is a passphrase as secure as a random string? It depends on the word count and the list. A four-word passphrase from a large word list is strong enough for almost any account and far more memorable. A five- or six-word one is comparable to a random 16-character string.

Are password managers safe? They are a much better trade than reusing passwords. The main risk shifts from “every site has my password” to “my master passphrase is the single point of failure” — which is a smaller, more controllable risk, especially with two-factor authentication on the manager itself.

Should I use symbols and numbers? Only if they come from a generator, or if a site forces you to. Deliberate substitutions of dictionary words add very little. Random symbols add entropy like any other character — but a longer plain password adds more.

Is it safe to use an online password generator? Only if it runs locally. Verify it: open the browser’s network tab and confirm no request carries the generated value. If you cannot verify it, generate offline.

Is it bad to write passwords down? On paper, kept physically secure, it is a reasonable trade-off. In a plaintext file, a screenshot, or a note-taking app that syncs to the cloud, it is not.