How to create a strong password you can actually remember

If you use the same password for your email, your bank and the site where you buy shoes, you are not the only one, because every survey on the subject finds that most people do. The trouble starts when one of those sites gets breached, which happens often, even to the big ones. From that moment your password is in lists that scammers try on every other site.

The way out is not to invent thirty memorable passwords. There are two or three passwords you have to hold in your memory, and all the others are better not known at all.

What makes a password hard to guess

Two things matter, and neither is the exclamation mark on the end.

The first is length. The second is unpredictability, meaning how hard it is to arrive at, starting from what is known about you or from a list of passwords already seen. Swapping an “a” for an “@” adds almost nothing, because the programs doing the guessing have known every such substitution for twenty years.

You will often meet lines like “eight characters fall in hours, sixteen take centuries”. Those are slogans. The real time depends on how the site stores its passwords, how many attempts per minute it allows, what hardware the attacker has, and above all on how genuinely random the password is. The rule that holds in every condition is simpler, and it is this: all else being equal, a long and genuinely unpredictable password resists far longer than a short or guessable one.

The only passwords you should memorise

These, and no more.

1. The unlock code for your phone and your computer.
2. The master password of your password manager, the one that opens all the rest.
3. The password to your main email account, because everything else is recovered from there, and you need it even when the manager is out of reach.

For those three, the sentence method works beautifully. Take four or five words with no connection between them, picked genuinely at random and not from a familiar phrase, and run them together, something like sofa-screwdriver-blueberry-october. It is long, it is easy to picture again in your head, and it looks like nothing a program could deduce about you. Do not use that one, though. It is printed here, so it will end up in the lists. Open a dictionary at random four times instead, or let the manager pick the words, since it has none of your tastes.

Two warnings about passphrases. The first is that it has to be genuinely random, because a proverb, a song lyric or a film title is already in every attacker’s list. The second is that each of the three has to be different: if one is discovered, the other two must survive intact.

All the others: better not to know them

And here comes the part that changes things. For the remaining thirty or forty accounts, the right password is a random string generated by the manager, different on every site, that you neither remember nor need to remember.

This is not about laziness. Any scheme a person invents is predictable. If you build passwords by sticking the site’s name onto the end of a fixed phrase, anyone who sees even one of them understands the pattern and guesses the rest in a handful of attempts, because all they have to change is the tail. The same goes for the site name, the year, the sequence number, any regular variation. A different password has to be unconnected to the others, not a variant of the same one.

And you already have a manager, inside your phone and inside your browser, free. I wrote up how to get it working in half an hour in password managers: why you need one and how to start.

Where to keep those two or three

Writing them on paper kept at home, in a drawer, is not heresy. The risk of someone entering your house to read them is far more remote than the daily certainty of a program trying stolen passwords against millions of accounts. Write the phrase, not which site it belongs to, and keep it away from the computer.

Two mistakes to avoid

Do not build a password on anything findable on social media: the dog’s name, your birthday, your football team. And never read one out to whoever asks for it by phone or email, even if they say they are the bank, because no real member of staff has any reason to ask.

The next step

With passwords sorted, the biggest improvement is turning on two-step verification for your email and your bank: from then on a stolen password, on its own, is no good to anyone. We cover it in two-step verification: what it is and how to turn it on.