Before you start
- A password manager (built into your browser or phone, or a dedicated app)
What makes a password strong
- Length matters most: 14+ characters, or 4+ random words.
- Randomness: not names, birthdays, pets, teams or song lyrics.
- Uniqueness: a different password for every account, so one leak can’t unlock the rest.
Swapping letters for symbols (P@ssw0rd) doesn’t help much; attackers try those patterns first.
Method 1 Make a memorable passphrase
-
Step 1: Pick random words
Choose 4–6 unrelated words, ideally at random (for example by opening a book at random pages, or using a password manager’s passphrase generator).
-
Step 2: Join them
Use spaces or dashes: velvet-cactus-orbit-spoon. Add a number or symbol only if the site requires it.
-
Step 3: Make a picture
Imagine a silly scene with the words, e.g. a velvet cactus orbiting a spoon. It’s easy to remember.
Method 2 Use a password manager for everything else
-
Step 1: Pick one
Use Google Password Manager, Apple Passwords, or a dedicated app like Bitwarden, 1Password or Proton Pass.
-
Step 2: Protect it
Lock it with your strong passphrase and two-step verification.
-
Step 3: Let it generate passwords
When signing up, accept the suggested random password. You never need to remember it.
Troubleshooting
Site rejects my passphrase
Some sites limit length or require symbols. Add a number and symbol, or let your password manager generate one that fits.
Frequently asked questions
How often should I change passwords?
Only when there’s a reason: a breach, a shared password, or a suspicious login. Frequent forced changes lead to weaker passwords.
Is it safe to save passwords in my browser?
Yes, if your device and account are protected with a strong lock and 2FA. It’s far safer than reusing passwords.
Summary
Use a passphrase of 4–6 random words for the few passwords you must remember, let a password manager handle the rest, turn on two-step verification, and switch to passkeys where you can.
