“Use a strong password” is useless advice when every site demands a different one and your brain holds maybe seven. But creating a strong password you can actually remember is very doable — the trick is passphrases: four random words strung together beat complex gibberish on both security and memorability.
I’ve converted dozens of password-reusers with these methods. Here’s what actually works, including the honest truth about password managers.
Method 1: Passphrases (My Top Recommendation)
A passphrase like correct-horse-battery-staple (the famous xkcd example — don’t actually use that one) is:
- Easy to remember: four common words form a mental image
- Hard to crack: ~44 bits of entropy — centuries against brute force
- Easy to type: no hunting for !@#$% on a phone keyboard
How to make yours: open a book, point at four genuinely random words (not a phrase — “iloveyou-so-much-baby” is guessable; “giraffe-pencil-tornado-muffin” is not). Add a number or symbol somewhere if a site requires it. One passphrase per important account — email, banking, password manager get their own.
The key insight: length beats complexity. A 20-character passphrase of plain words is vastly stronger than an 8-character “P@ssw0rd!” — and you can actually remember it. The math is unambiguous here.
Method 2: The Formula System (One Master, Many Variants)
If passphrases feel like too many to memorize, use a formula:
- Pick a memorable base: e.g., “BlueTiger!dances” (yours, not this)
- Add a per-site component: first two + last two letters of the site — Amazon → “am-on” → “BlueTiger!dances-am-on”
- Result: unique per site, memorable via the formula, long and complex
Honest assessment: better than reusing one password, weaker than truly unique passwords — if one leaks and the attacker figures out your pattern, the rest fall. It’s a solid stepping stone, not the destination. The destination is…
Method 3: A Password Manager (the Actual Answer)
I’ll be straight: the real answer is a password manager. Bitwarden (free, excellent), 1Password, or Apple’s/Google’s built-in managers. You memorize one strong master passphrase; the manager generates and remembers unique 20-character passwords for everything else.
Objections I’ve heard, answered:
- “What if the manager gets hacked?” Reputable managers use zero-knowledge encryption — they never have your master password, so breaches expose only encrypted blobs. Your master passphrase + 2FA on the manager = very safe.
- “I don’t trust the cloud.” Bitwarden can self-host; KeePass is fully offline. Options exist for every paranoia level.
- “It’s a hassle.” The first week is setup; after that it’s less hassle than passwords — autofill does the typing.
- “My browser already saves passwords.” Better than nothing! Chrome/Edge/Safari managers are fine starters — but a dedicated manager works across all browsers and devices with stronger generation.
Start today: install Bitwarden (free), import your browser’s saved passwords, and change your email and banking passwords to generated ones first. That 30-minute session is the highest-ROI security upgrade after 2FA.
What Makes Passwords Crackable (Avoid These)
- Reuse: the #1 sin. One breach (check haveibeenpwned.com) exposes every account sharing that password to automated credential-stuffing.
- Predictable substitutions: “P@ssw0rd” isn’t clever — crackers try leetspeak first. It’s in every dictionary.
- Personal info: pet names, birthdays, addresses, favorite teams — all guessable from your social media in minutes.
- Short length: under 12 characters is brute-forceable with modern hardware; aim for 14+ (or 4+ word passphrases).
- Keyboard patterns: “qwerty123,” “1q2w3e4r” — cracked instantly.
- “SeasonYear” patterns: “Summer2026!” — attackers know this pattern intimately.
And the password-change myth: forced regular password changes are outdated advice (even NIST reversed it). Changing a strong password every 90 days just produces weaker passwords (“Summer2026!” → “Fall2026!”). Set a strong unique password once; change it only if breached.
The Minimum Viable Password Strategy (Start Here)
Overwhelmed? Do just this, in order:
- Today (15 min): create a unique passphrase for your email — the master key. Enable 2FA on it.
- This week: unique passphrases for banking, PayPal/Venmo, and your password manager (if you install one).
- Ongoing: as you log into other sites, change reused passwords to unique ones. No rush — opportunistic improvement.
- Check exposure: run your email through haveibeenpwned.com and change anything breached.
- Write down master passwords — yes, really. A passphrase on paper in your desk drawer beats a “clever” password you forget and reset insecurely. Attackers are remote; burglars aren’t reading your desk drawer for passwords.
Security is a spectrum, not a pass/fail. Going from “one password everywhere” to “unique passphrase on email + 2FA” eliminates ~95% of your realistic risk. The password manager gets you the last 5%. CISA’s password guidance backs the passphrase approach officially.
Bonus: Passkeys Are Replacing Passwords (and That’s Great)
Worth knowing: the industry is moving to passkeys — cryptographic logins tied to your device’s biometrics (fingerprint/face). No password to remember, nothing to phish, nothing to leak in a breach. Google, Apple, and Microsoft all support them now, and major sites are rolling them out.
When a site offers “create a passkey,” say yes — it’s strictly better than any password. You’ll still need passwords for years (not every site supports passkeys yet), so everything above remains relevant. But the direction is clear: memorize fewer secrets, not more. Enable passkeys where offered, keep your password manager for the rest, and enjoy the slow death of the password.
Keep Reading
If this was useful, you might also like two-factor authentication and signs your email was hacked.
The Bottom Line
Use passphrases (four random words) — longer beats more complex, and you can actually remember them. Get a password manager (Bitwarden is free) for everything else. Minimum viable plan: unique passphrase + 2FA on your email today, banking this week, everything else opportunistically. Never reuse, never use personal info, and stop the 90-day change ritual — it does more harm than good.
Frequently Asked Questions
How long should a strong password be?
At least 14 characters for random passwords, or 4+ random words for passphrases. Length is the dominant factor — a 20-character passphrase of plain words beats an 8-character complex password by orders of magnitude.
Is it safe to write passwords down?
For your few memorized master passphrases, yes — paper in a secure spot at home. The threat model for most people is remote attackers, not burglars hunting passwords. It’s far safer than reusing a memorable password everywhere.
Are password managers safe from hackers?
Reputable ones (Bitwarden, 1Password) use zero-knowledge encryption — even the company can’t read your vault. Combined with a strong master passphrase and 2FA, it’s the safest practical option available.
