How to Make a Strong Password You Can Remember

For years, websites told us to use short passwords full of capitals, numbers and symbols, and to change them every few months. The result was passwords like Pakistan@123, which are hard to remember and easy to guess. Current guidance says the opposite: length matters most, and a long phrase you can remember beats a short jumble you cannot.

What makes a password strong

Attackers do not guess passwords one letter at a time by hand. They use software that tries billions of combinations, starting with leaked passwords, dictionary words and common patterns such as a name followed by a year. A password is strong when it is long, random and used nowhere else.

The US National Institute of Standards and Technology (NIST), whose guidance many organisations follow, now says that a password used on its own should be at least 15 characters long. It also tells websites to stop forcing a mix of character types and to stop making people change passwords on a schedule.

The passphrase method

A passphrase is four or more random words strung together. It is long, so it is strong, and it is made of words, so you can remember it.

1. Pick words at random. Open a book or dictionary at random pages and take the first noun you see, or roll dice against a word list. Do not choose words that mean something to you.
2. Use at least four words, ideally five. For example: lantern mango gravel orbit. That is 25 characters.
3. Make a picture in your head. A lantern hanging on a mango tree above a gravel path, with a planet in orbit behind it. Silly pictures stick.
4. Join them however you like. Spaces, hyphens or capitals are fine: Lantern-Mango-Gravel-Orbit. They help you type it, but the strength comes from the random words.

Words you chose yourself, song lyrics and famous quotes are weak, because attackers’ word lists include them.

What to avoid

• Names, birthdays, phone numbers, CNIC or Aadhaar digits, and your city or team.
• Keyboard patterns such as qwerty or 1qaz2wsx.
• Common words with swapped letters, such as P@ssw0rd. Cracking software tries these first.
• Using the same password on more than one site. When one site is breached, attackers try the same email and password everywhere else.

You only need to remember a few

Nobody can remember a different passphrase for 50 accounts. Remember strong passphrases for the two or three that matter most: your phone, your main email and your password manager. For everything else, let a password manager generate and store a random password. Google Password Manager, iCloud Keychain and Bitwarden are all widely used.

When you need a random password, the Password Generator creates one in your browser. Choose a Length of 16 or more, tick the character types the site accepts, and tick Avoid look-alikes if you will ever type it by hand. The strength line shows roughly how many bits of entropy it has. Tap Copy, save it in your manager, and tap New password for the next one.

Turn on two-step verification

Even a strong password can be stolen by a fake login page. Two-step verification, using an authenticator app or a passkey, means a stolen password alone is not enough to get into your account. Turn it on for your email, banking and social media first.