How to Create a Strong Password You Can Actually Remember

Most password advice focuses on complexity rules: one uppercase letter, one number, one symbol. Those rules produce passwords like Summer2026!, which tick every box and are among the first guesses any cracking tool tries. What actually makes a password hard to crack is length and randomness. This guide explains how passwords really get cracked, what "strong" means in numbers, how to build passwords you can remember for the few you must type, and why you shouldn't remember the rest.

How passwords actually get cracked

Attackers rarely sit at a login page guessing; rate limits and lockouts make that slow. The real danger is a data breach: a site's database of password hashes is stolen, and the attacker guesses offline as fast as their hardware allows, often tens of billions of guesses per second against weakly hashed passwords.

They don't guess alphabetically. Cracking tools work through lists of hundreds of millions of real leaked passwords, then common words with predictable changes: capital first letter, a year on the end, a swapped for @, ! at the end. That is why "clever" human patterns fall so fast. The other big threat is credential stuffing: trying passwords leaked from one site on your email, bank and shopping accounts, which only works if you reuse them.

Why length beats complexity

Every character you add multiplies the number of possibilities an attacker must try. For truly random passwords:

The key word is random. These numbers only apply when every character is chosen by chance. A 12-character password built from a word, a name and a year is far weaker than its length suggests, because attackers try those patterns first.

Two kinds of strong password

Random passwords, for almost everything

For every account you log into through a password manager, use a random password of at least 16 characters, generated by a machine and never typed by you. You don't need to remember it, so there is no reason to make it short.

1. Open the Password Generator.
2. Set the length to 16 or more (20+ for email and banking) and choose the character types. If a site rejects symbols, turn them off and add a few characters of length instead.
3. Generate and save the password straight into your password manager.

The generator uses your browser's cryptographic random number generator, so the output is genuinely unpredictable, and it is created on your device.

Passphrases, for the few you must remember

You still need a handful of passwords you can type from memory: your password manager's master password, your computer login, perhaps your main email. For these, use a passphrase of several random, unrelated words, such as lantern-orbit-cactus-mellow-fjord-tidal.

The words must be chosen at random (by dice, or by a generator), not picked by you. People pick related words and famous phrases, which attackers try first. With a standard list of 7,776 words, each randomly chosen word adds about 12.9 bits of strength: five words give about 65 bits and six words about 78 bits, enough to resist serious offline attacks. Three or four words isn't enough on its own.

Check a password you already use

1. Open the Password Strength Checker.
2. Type the password to see its entropy, an estimated crack time and the specific weaknesses (dictionary words, sequences, dates).
3. If the estimate says seconds, minutes or days, change that password now, starting with your email.

The check happens in your browser, and nothing you type is sent anywhere. Our guide to password strength checking explains how the estimate is calculated.

The habits that matter more than any single password

• Never reuse passwords. A breach of one forgotten forum shouldn't open your email. Unique passwords everywhere make credential stuffing useless.
• Use a password manager. It generates, stores and fills unique passwords, so you only remember one strong passphrase. Bitwarden, 1Password and the managers built into browsers and phones all work.
• Turn on two-factor authentication. Start with email, banking and your password manager. An authenticator app or passkey is stronger than SMS codes.
• Protect your email above everything. Password resets for every other account go there, so it deserves your strongest passphrase and two-factor authentication.
• Change passwords when there is a reason, such as a breach notice or suspicion of compromise, rather than on a fixed schedule. Current guidance from NIST (SP 800-63B) drops forced periodic changes and composition rules, and puts the weight on length and on blocking known-breached passwords.
• Consider passkeys. Many sites now support passkeys, which replace the password with a key stored on your device. They can't be phished or reused, and they are worth enabling where offered.

Frequently asked questions

Is a long simple password better than a short complex one?

Almost always, yes, provided it isn't a common phrase. Length multiplies the search space; swapping a for @ barely helps, because crackers try those substitutions first.

How do I remember dozens of random passwords?

You don't. That's the password manager's job. You remember one strong passphrase that unlocks it.

Are password managers safe?

A reputable manager with a strong master passphrase and two-factor authentication is far safer than reused or memorable passwords, which is the realistic alternative.

Should I write passwords down?

A written list kept safely at home is safer than reusing one password everywhere. Never keep it with the device, or in an unencrypted note on your phone.