How to Create Strong Passwords You Can Actually Remember

If you have ever struggled to remember a password, you are not alone. Many websites ask for long passwords with a mix of letters, numbers, and symbols, and it can be tempting to reuse one that you already know.

Learning how to create a strong password does not have to mean memorizing a jumble of random characters. A better approach is to use long, unique passwords and let a trusted password manager remember most of them for you.

What you’ll need

• A little time to review the accounts that matter most.
• A password manager, if you choose to use one.
• Access to the email address or phone number you use for account recovery.

Step 1: Understand what makes a password strong

A strong password is difficult for someone else to guess or discover. Length matters: a longer password generally gives an attacker many more possibilities to try.

A password should also be unique. That means you use a different password for each important account, rather than using the same one for email, shopping, banking, and social media.

Try to avoid passwords based on:

1. Your name, birthday, address, or phone number.
2. A family member’s or pet’s name.
3. Simple patterns such as 123456, password, or qwerty.
4. A familiar word with a predictable number or symbol added to the end.
5. A password you have already used on another website.

Information about you may be easier to find than you think. Details shared on social media or in public records can sometimes help someone guess a password.

Good to know: A password does not become safe just because it contains a capital letter, a number, and a symbol. A long, unpredictable password is usually a better choice than a short password with a few predictable changes.

Step 2: Use a long passphrase for passwords you must remember

A passphrase is a password made from several words. It can be easier to remember than a short string of random characters, while still being difficult to guess when the words are chosen unpredictably.

For a password you need to remember, you can use this general approach:

1. Think of several unrelated words rather than a familiar saying or quotation.
2. Avoid words connected to your name, hobbies, family, or other public details.
3. Follow the website’s password rules for length and permitted characters.
4. Do not reuse the passphrase on another account.
5. Avoid using the examples in this guide as real passwords.

For example, a fictional passphrase might look like a group of unrelated words with separators between them. Do not use a published example as your own password, because other people can see it too.

Tip: If you need to remember a password yourself, choose a method that helps you recall a long, unusual combination. Avoid turning it into a familiar phrase, lyric, quotation, or personal detail that someone could guess.

Step 3: Use a password manager for the rest

You do not need to remember a different complicated password for every website. A password manager is an app that securely stores your passwords and can create strong, random ones for you.

Most password managers work across computers and phones. Some are built into your browser or device, while others are separate apps.

1. Choose a password manager you trust. You might use the password manager built into your browser or device, or a reputable dedicated service.
2. Set it up using the official app or website.
3. Create a strong, unique master password if the service requires one.
4. Turn on any available account recovery and security options.
5. When creating a new account, use the manager to generate and save a unique password.

The master password is the main password that protects the password manager itself. It is especially important, so make it strong and keep it private.

Careful: Never share your master password or approve an unexpected request to reveal it. A password manager provider should not need you to tell a caller or email sender your master password.

Step 4: Protect your email and other important accounts first

Your email account is particularly important because it is often used to reset passwords for other services. If someone gains access to your email, they may be able to request password resets elsewhere.

Start with these accounts:

1. Your main email account.
2. Your bank and financial accounts.
3. Your Apple, Google, or Microsoft account.
4. Shopping accounts that store payment details.
5. Social media and messaging accounts.

Give each account its own password. If you have reused a password on several websites, change it on the most important accounts first and then work through the rest.

You can usually change a password by opening the account’s Settings, Security, or Sign-in section. If you cannot find the option, search the service’s official help pages rather than following a link in an unexpected message.

Step 5: Turn on two-step verification

A strong password is important, but it is not the only way to protect an account. Two-step verification adds another check when you sign in, such as an approval on your phone or a code from an authenticator app.

1. Sign in to the account using its official website or app.
2. Open Settings, then look for Security, Sign-in, or Two-step verification.
3. Follow the instructions to set up an available verification method.
4. Save any recovery codes somewhere secure, separate from the device you use to sign in.
5. Review the account’s trusted devices and sign-in alerts.

Some services call this feature two-factor authentication (2FA) or multi-factor authentication (MFA). The names differ, but the idea is the same: a password alone is not enough to complete the sign-in.

Step 6: Check for weak or reused passwords

If you have been using the same password for years, it is worth reviewing your accounts. Many password managers can identify weak, reused, or exposed passwords and suggest which ones to change.

1. Open your password manager.
2. Look for a section called Security Checkup, Password Checkup, or similar.
3. Review any warnings about weak or reused passwords.
4. Change passwords through the official websites or apps for those accounts.
5. Save the new unique passwords in your manager.

If a service tells you that your password appeared in a data breach, change it on that service and anywhere else you reused it. A data breach is an incident in which information is exposed or accessed without permission.

Troubleshooting: Common password questions

What if I forget my password?

Use the Forgot password? link on the service’s official sign-in page. Follow its recovery steps, then save the new password in your password manager.

Is it safe to let my browser save passwords?

Built-in password managers can be useful when protected by your device’s sign-in and security features. Make sure your computer or phone has a strong screen lock, and do not share your device account with other people.

Should I change every password regularly?

You generally do not need to change a strong, unique password on a fixed schedule if it has not been exposed and there is no sign of unauthorized access. Change it promptly if a service reports a breach, you suspect someone knows it, or you have shared it by mistake.

Can I write passwords down?

A secure password manager is usually more convenient. If you need a written backup for a password you must remember, keep it in a private, secure place where visitors cannot see or access it. Never leave passwords beside your computer or on a note attached to the screen.

Make password safety easier

You do not need to memorize dozens of complicated passwords. Use a long, unique passphrase where you need to remember one, let a trusted password manager create and store the rest, and turn on two-step verification for important accounts. A few sensible habits can make your online accounts much harder to break into.