How do I create a secure password that I can actually remember?
A pet’s name with an exclamation point and a year bolted on is one of the first patterns a cracking tool tries. It feels like effort. The tool disagrees.
The short answer
Use a passphrase made of 4 to 5 random dictionary words (e.g. battery-staple-correct-horse) or use a password manager to generate 20 random mixed characters.
Step 1: Understand that length beats complexity
Every extra character multiplies the number of guesses an attacker has to work through. Four or five words chosen at random are both longer than eight mixed characters and far easier to remember. Substituting 3 for E adds almost nothing, because the cracking tools try that substitution too.
Step 2: Never reuse passwords across sites
When a random forum gets breached, automated bots try that exact email and password on banking, email, and shopping sites within minutes.
Step 3: Turn on two-factor authentication (2FA)
Use an authenticator app (such as Aegis, Bitwarden, or 1Password) rather than SMS text messages when possible.
Common mistakes
- Replacing letters with the obvious numbers and symbols, as in P@ssw0rd1.
- Using the same master password everywhere.
- Writing passwords on a sticky note attached directly to your computer monitor.