How to create strong passwords you can actually remember

You don’t need to memorize a different jumble of letters, numbers and symbols for every account. A long passphrase, a plan for storing passwords and a second sign-in step can make account security more manageable.

Why a memorable password matters

A strong password needs to do two jobs: be difficult for someone else to guess and practical enough for you to use. Length can help, without forcing you to rely on tricky substitutions such as replacing every letter “a” with a symbol.

Guidance from the National Institute of Standards and Technology, or NIST, emphasizes password length and does not require services to impose rules such as including a capital letter, number and symbol. Individual websites may still have their own requirements.

How to create a long, random-word passphrase

A passphrase is a password made from a sequence of words. One approach is to select four or five unrelated words at random, then join them with spaces or another separator if the account allows it.

1. Use a random word-selection method rather than choosing words that naturally go together. For example, follow the instructions for a word list designed to be used with dice.
2. Select four or five words independently. Keep their order as selected.
3. Join the words with spaces or hyphens if the site accepts them.
4. If a site requires a number or symbol, add one in a way you can remember. Avoid simply putting “1!” at the end.
5. Check the account’s requirements and save the finished passphrase securely.

For illustration, a phrase might look like “lantern-cabbage-river-thimble.” Don’t use this example: it has appeared in an article. Make your own instead, and don’t share it.

How to remember your passphrase without using personal details

Avoid building a passphrase around details someone might know or discover about you, such as a pet’s name, a birthday or a street address. Also avoid familiar sayings and song lyrics. The aim is to make the words memorable after they’re chosen, not to choose a phrase someone could readily associate with you.

Try making a mental picture that connects your randomly selected words in order. The picture can be silly or surprising. Repeat the passphrase a few times while you learn it, then practice recalling it later without looking.

If you need a written reminder, decide where to keep it before you create one. A private, secure location is preferable to a note attached to your device. Don’t put the passphrase itself in a password hint.

Use a different password for each account

Reusing a password can put more than one account at risk if that password is exposed. Give each account its own password, including accounts you rarely visit.

If updating everything at once feels daunting, start with the accounts that matter most to you, such as your main email and financial accounts. Work through the rest over time. When you find a reused password, replace it with a different one for each account.

Consider a password manager for yourself or your family

A password manager is an option for keeping track of unique passwords. You can use a memorable, strong passphrase for the manager rather than trying to remember every account password yourself.

Before choosing one, check how it works on the devices your household uses and what happens if you forget the main password. If family members need shared access to an account, look at the sharing and recovery options. Discuss who should have access and what each person should do if they get locked out.

Set aside time to learn the recovery process before you need it. Keep any recovery information somewhere secure and accessible to the appropriate person.

Add a second sign-in step and know when to change a password

When an account offers multi-factor authentication, consider turning it on. This adds another sign-in step alongside your password. The options vary by service; review those offered and choose one you can use and recover if necessary.

You don’t need to change a password on a fixed schedule simply for the sake of changing it. Change it if you suspect it has been exposed or someone else has accessed the account. If you reused it elsewhere, change it on those accounts too, using a different password for each.

Start with one account today: create a unique password, check its recovery settings and turn on an available second sign-in step. Then move on to the next account when you have time.