How to Create Strong Passwords You Can Remember (Passphrases)
Why long passphrases beat complex short passwords, how to create one in two minutes, which passwords to memorise, and how to protect everything else.
"Use at least eight characters with a capital letter, a number and a symbol." That rule produced millions of passwords like Summer2024!, which are hard to remember and easy for computers to guess. Security guidance has moved on: length matters more than complexity, and a few random words beat a short jumble of symbols.
Why length wins
Attackers use software that tries billions of guesses, starting with common words, names, dates and predictable substitutions such as @ for a. A short password with symbols follows patterns the software knows. A long passphrase made of random words has so many possible combinations that guessing it becomes impractical.
| Example | Easy to remember? | Hard to guess? |
|---|---|---|
P@ssw0rd! | Somewhat | No: a well-known pattern |
Summer2024! | Yes | No: season plus year is common |
copper-violin-tunnel-mango | Yes | Yes: four random words |
x7#Qm2!pL9 | No | Yes, but only if never reused |
How to create a passphrase in two minutes
- Pick four to six random words that have no connection to you or each other. The words must be random; a famous quote or song lyric is not.
- Join them with a separator such as a hyphen or space:
orbit-saddle-lemon-quiet. - Optionally add a number or a capital if a website requires one:
Orbit-saddle-lemon-quiet-7.
The easiest way to get truly random words is a password manager's passphrase generator. People are bad at choosing randomly; software is not.
Make it memorable
Picture a small scene linking the words: an orbiting saddle on a quiet lemon. Silly images stick. Type it a few times on the first day and it will become automatic.
Which passwords to memorise
You only need to remember a few:
- Your password manager's master password
- Your main email account (it can reset everything else)
- Your computer or phone login
Every other account should have a unique, generated password stored in a password manager. You never type or remember those.
Never reuse passwords
When one website is breached, attackers try the leaked email and password on other sites. If you reuse passwords, one breach becomes many. Unique passwords stop this completely.
Add a second layer
Turn on two-factor authentication (2FA) for email, banking, social media and your password manager. Even if someone learns your password, they also need a code from your phone or a security key. Authenticator apps are safer than codes by text message.
Signs it is time to change a password
- The service tells you it has been breached
- Your password manager's breach alert flags it
- You shared it with someone and no longer want them to have access
- You notice logins you do not recognise
There is no need to change strong, unique passwords on a schedule if none of these apply.
The simple system
- One strong passphrase for your password manager
- Unique generated passwords for everything else
- Two-factor authentication on important accounts
SecureKey Password Manager generates passphrases, stores every login securely and warns you about breaches. Sharing passwords at home? Read our guide to password managers for families.