In plain English
How to remember a long password
The Simple Answer
Use a few unrelated words that a machine picked at random, join them together, and turn them into a picture or a tiny story. Leave out birthdays, names and anything someone could find on your social media.
A long password is hard to guess and, done right, easier to remember than a short one full of symbols. The trick is in how you build it.
Why dates and names are a weak start
It feels clever to build a password from something only you know: your dog and the year you were married, or your daughter's birthday. The UK National Cyber Security Centre warns against exactly this. It lists significant dates such as birthdays and anniversaries, family and pet names, and favorite sports teams as things to avoid, and points out that most of these details can be found on your social media profile.
It also warns against swapping letters for numbers, such as an 0 for an O. Criminals know that trick too.
| Password idea | Why it is weak |
|---|---|
| Rex2014! | A pet name and a year, with a symbol on the end. All three are easy to guess or look up. |
| Sunshine! | A common word with a common ending. |
| P@ssw0rd | The classic swaps. Everyone knows them. |
| pelican-hammock-mint-glacier-turnip | Five unrelated words picked by chance. Nothing about it points back to you. |
Let chance pick the words
If you choose the words yourself, you will pick ones that mean something to you, and that makes them guessable. CISA suggests a memorable phrase of four to seven unrelated words. The UK NCSC suggests three random words as a minimum. Either way, the word "random" matters, so use a tool to pick them.
The Password Generator on this site has a Memorable words mode that does this. It picks each word at random from a list of 978 common words, never repeats one, and joins them with hyphens. Five words give about 49.7 bits of strength, and each extra word adds about 10 more. Do not copy the example above. Make your own.
Make it stick
- Turn the words into a picture. A pelican sitting in a hammock, eating a mint, next to a glacier, holding a turnip. The sillier it is, the better you will remember it.
- Say it out loud a few times, then type it.
- Type it from memory the next day, and again two days later. Spacing the practice out works better than doing it ten times in a row.
- Do not tape it to the monitor. If you must write it down, keep it somewhere private at home.
You only need to remember a few
CISA recommends a different strong password for every account and says a password manager is one of the easiest ways to manage them: it creates, stores and fills in passwords, so you only remember one master password. That is the one worth a memorable phrase. Everything else can be long and random and live in the manager.
Password Generator: Choose Memorable words to get a phrase of unrelated words. It is made in your browser and never stored or sent.
Password Strength Checker: See an estimate of how strong a password is. It runs in your browser and does not keep what you type.