How to create a strong password you can actually remember

A strong password is long, random and used on one site only. For the few passwords you have to remember, use a passphrase: eight or nine random words in a row, easy to picture and hard to guess. Keep every other password in a password manager, and turn on two-step verification on your email and your bank.

Long beats complicated

Most of us learned that a good password looks like P@ssw0rd2024!: a capital letter, a number, a symbol. It looks strong, but it isn't. People build these passwords in the same predictable ways (a word, a capital at the start, @ for a, a year and a ! at the end), and the programs attackers use to guess passwords try exactly those patterns first.

What makes a password hard to guess is the number of possibilities an attacker has to try. That number is measured in bits of entropy: each extra bit doubles the work. Two things raise it: length, and choosing at random instead of by hand. The US standards agency NIST, in its digital identity guidelines, now tells websites to accept long passwords (at least 64 characters), to stop forcing mixes of symbols and capitals, and to stop making people change passwords on a schedule.

Here is how different choices compare in the eThorns password generator, which shows the exact strength of each result. The examples are only examples: don't use them.

Type	Example	Strength shown
8 random characters	k#9Tq!vR	50 bits: fair
12 random characters	W7m$pe2!Lx4q	77 bits: strong
6 random words	lemon-ladder-quiet-owl-bake-river	53 bits: fair
9 random words	tulip-anvil-swift-cocoa-hike-raven-dune-mug-jolly	80 bits: very strong

Random characters pack more strength into fewer characters, but you won't remember W7m$pe2!Lx4q, and you'll struggle to type it on a phone. The words are longer, yet easy to picture: a lemon on a ladder, a quiet owl. That's why passphrases are the best choice for the handful of passwords you type by hand.

How to make a passphrase

1. Open the password generator and choose Passphrase. It runs on your device with the browser's secure random generator, and nothing is sent or stored.
2. Set the number of words. Its word list has 506 short English words, so each word adds about 9 bits. The default of 8 words gives 71 bits; 9 words reach 80, which is what the tool suggests for important accounts.
3. Pick a separator (a hyphen, a space, a dot or an underscore). If a site demands a capital letter or a number, tick "Capitalize words" or "Add a digit".
4. Choose one of the 5 results as it is. Don't swap words for ones you like better: the strength depends on the words being picked at random, not by you.
5. Make up a silly scene with the words, and type the phrase a few times over the next days so it sticks.

Song lyrics, sayings and quotes don't count as passphrases. They are long, but they are in lists that attackers try.

A password manager for everything else

You can't remember a different passphrase for 80 accounts, and you don't need to. A password manager is an app that stores your passwords encrypted, fills them in for you and creates new random ones. You only remember one: the main password that unlocks it.

• Built-in managers are a good start: the Passwords app on iPhone and Mac, or Google Password Manager on Android and in Chrome. They sync across your devices.
• Dedicated managers, some of them free, work on any phone, computer and browser, which helps if you mix brands.
• Protect the manager with a passphrase you use nowhere else, and turn on two-step verification on the account behind it.
• Write that main passphrase on paper and keep it at home, somewhere safe. Paper at home is much safer than a note on your phone called "passwords".

A manager also protects you from fake websites. It fills your password only on the site where you saved it, so if it doesn't offer to fill in on a page that looks like your bank, stop and check the address.

Never reuse a password, especially these two

When a website is breached, attackers take the stolen email and password pairs and try them automatically on email services, banks and shops. If you used the same password there, they get in. Our guide has my password leaked? explains how this works and how to check.

Two passwords matter more than all the others:

• Your email. Almost every "forgot your password" link goes to your email, so whoever controls it can reset the rest.
• Your banking and wallet apps. Their password or PIN should not be your phone's unlock code, your card PIN, or anything you've used on another site.

Turn on two-step verification

Two-step verification (also called 2FA) asks for a second proof after the password, so a stolen password alone isn't enough. From strongest to weakest:

1. A passkey or a security key. A passkey lets you sign in with your fingerprint, face or phone PIN instead of a password, and it only works on the real site, so it can't be phished.
2. An authenticator app that shows a 6-digit code that changes every 30 seconds.
3. A code by text message. It's the weakest, because phone numbers can be stolen, but it's far better than nothing.

Save the backup codes the site gives you in your password manager or on paper. And never give a code to anyone who calls or writes to you: no real bank or company asks for it. For WhatsApp, which has its own setting, see WhatsApp two-step verification.

What to do with the passwords you already have

You don't have to fix everything tonight. Do it in order, most important first.

1. Collect them. Set up a password manager and import the passwords your browser has already saved. Most managers can do this in a few clicks.
2. Find the bad ones. Most managers, including the built-in ones, list passwords that are reused, weak or found in breaches. You can also check a single password with the leaked password check: only 5 characters of its fingerprint leave your device.
3. Change your email password first, to a new passphrase. Then the account behind your phone (Apple or Google), your banks and wallets, and the password manager itself.
4. Then the accounts with your card or personal data: online shops, delivery apps, social networks and work accounts. Let the manager generate a random password for each.
5. For everything else, change as you go. Each time you log in to an old account, replace its password with a generated one, or delete the account if you no longer use it.
6. Turn on two-step verification on every account where you change a password, starting with email and bank.

Always change passwords by typing the site's address yourself or opening the official app, never from a link in a message.

Quick checklist

• A passphrase of 8 or 9 random words for my email and my password manager.
• Every other password random, unique and saved in the manager.
• No password shared between my email, my bank and anything else.
• Two-step verification on email, bank and the password manager.
• Backup codes saved somewhere safe.
• Old and reused passwords being replaced, most important first.

Frequently asked questions

Is it safe to let my browser or phone save my passwords?

Yes, on your own device with a screen lock. It's far safer than reusing one password everywhere. Don't save passwords on a shared or public computer.

What if my password manager gets hacked?

Good managers encrypt your passwords with your main password before storing them, so a stolen copy is useless without it. That's why the main passphrase must be long and unique, with two-step verification on the account.

Can I use words in Spanish or another language?

Yes. The language doesn't matter; randomness does. The generator's list is in English, but random words from any language work if you don't choose them yourself.

A site won't accept my long passphrase. What should I do?

Some sites still limit length or reject spaces. Try a hyphen as the separator, or let your password manager create a random password that fits the site's rules.

Try it

• 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
• 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.