How to make a strong password you can remember

You have been told to use a strong password. So you add a capital letter, a number and an exclamation mark to your dog’s name, and the website says “strong”. Then you cannot remember which of your twenty accounts uses which version.

That advice is out of date, and it makes you do more work for less safety. This post shows what a strong password really is, a simple way to make one you can remember, and where to stop remembering altogether.

What makes a password strong

A strong password is one that is hard to guess, and the most useful way to make one hard to guess is to make it long and unusual. The UK National Cyber Security Centre (NCSC), the British government’s security agency, puts it this way: the longer and more unusual your password is, the harder it is for a criminal to crack.

Notice what is missing from that. Nothing about swapping letters for symbols or adding a number on the end. Criminals’ tools already try those tricks. The NCSC says that if you change letters in a password, for example swapping an “o” for a zero, criminals know these tricks too. The password is not much stronger, but it is harder for you to remember.

The official standards have moved the same way. The US standards body NIST publishes the rules that many government systems follow. Its current guidance on passwords says that a password used on its own should be at least 15 characters long. It also says websites should not force you to mix character types, and should not make you change a password on a timer unless there is evidence it has been stolen.

So length wins, and rules like “must contain a symbol” are not what protects you.

The three random words method

The NCSC recommends joining three random words. Their own example is applenemobiro. It is long enough and strong enough for most accounts, and far easier to remember than P@55w0rd!7.

The word “random” is doing the work. Here is how to do it properly:

1. Pick three words that have nothing to do with each other and nothing to do with you.
2. Do not pick a phrase from a song, a prayer, a film or a saying. Those are easy to guess.
3. Join them together. Longer is fine: four words is stronger than three.
4. Use the password for one account only, and never reuse it.

A quick way to get random words is to open a book or a dictionary at a page you did not choose and take the first word you see, three times. Rolling dice against a word list does the same job. What does not count as random is the three words that came to mind first, because most people’s first three are very similar.

What to avoid

These are the ones criminals try first:

• Names of family, pets and your favourite football team. Much of this is on your social media already.
• Birthdays, anniversaries and your phone number.
• The word “password”, “admin”, “welcome”, or a keyboard run like “qwerty”.
• Your business name with a year on the end.
• The same password with a different last digit for each account.

The NCSC lists significant dates, sports teams, and family and pet names as things to avoid for exactly this reason: most of those details can be found on your social media profile.

The bigger problem is reuse

Even a perfect password fails if you use it in two places. When one website is breached and your email and password leak, criminals try the same pair on your email, your bank and your other accounts. This is why one strong password is not the goal. A different strong password for each account is.

Nobody can remember fifty different three-word passwords. That is not a flaw in you. The NCSC says as much: it is working to reduce how much organisations depend on people recalling large numbers of complex passwords.

Remember a few, store the rest

Here is a split that works for most business owners:

• Remember three or four passwords. Your password manager, your main email, and your phone or computer login. Make these three-word passwords.
• Let a password manager make and hold the rest. It creates a long random password for each account and fills it in for you. You never type or remember them.
• Add a second step to the important ones. Turn on two-step verification, where a code or a tap on your phone is needed as well, for email, banking and your website’s admin login.

If a password manager is new to you, Are password managers safe? answers the worry most people have first. When you are ready to choose one, our heylogin compared with 1Password and Bitwarden post sets the options side by side.

NIST’s guidance also says websites should check new passwords against lists of commonly used or stolen ones, and refuse any that appear. If a site tells you a password is “too common”, take that seriously and choose something else.

What to ask your team

If other people log in to your accounts, a strong password you remember is not enough, because they need it too. Ask:

• Where do our shared logins live today? If the answer is a chat group or a spreadsheet, anyone who ever had access to that still has the passwords.
• When a person leaves, who changes the passwords they knew?
• Which accounts have a second step turned on, and which do not?
• Does anyone use the same password for work and personal accounts?

Want us to check yours?

Passwords are the front door, but your website and your email domain are the building. Run our free website security checker to see what your site shows the outside world.

If your team shares logins, our heylogin service moves them into a proper password manager, changes the ones that were exposed, and trains your staff. You can also reach us directly:

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Three random words, NCSC, reviewed 21 December 2021. Source for the three random words method, the applenemobiro example, longer and more unusual passwords being harder to crack, avoiding dates, teams, family and pet names, and character swaps adding little strength.
• Password policy: updating your approach, NCSC. Source for the aim of reducing reliance on people recalling many complex passwords.
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, NIST. Source for the 15 character minimum for passwords used alone, no forced character mixing, no routine forced changes unless there is evidence of compromise, and checking new passwords against lists of common or compromised ones.