Original diagram — the real risk is not one weak password. It is one password used everywhere.

How to Create a Strong Password You'll Actually Remember

Most password advice is wrong. Not slightly wrong — structurally wrong. For twenty years, websites told you to use eight characters with uppercase, lowercase, a number and a symbol, and to change it every ninety days. The organisation that sets US government authentication standards has since said that approach does not work, and recommended against most of it.

This guide explains what replaced the old advice, why the thing that actually matters is not complexity but uniqueness, and how to get from where you are now to a strong setup without spending a weekend on it. The practical part — how to actually start with a password manager — is the section most articles skip, and it is the section most people need.

Key takeaways

The real risk is reuse, not weakness. One breach exposes every account that shares the password.
NIST — the body behind US federal authentication standards — now recommends against forced composition rules and periodic rotation.
Length matters more than complexity, but only if the randomness is real. Human-chosen "complex" passwords follow predictable patterns.
A password manager solves the entire problem — you remember one strong passphrase, and it generates and stores unique random passwords for everything else.
Passkeys are the structural fix: phishing-resistant, nothing to steal, and increasingly supported by Google, Apple, Microsoft and major banks.

1. Why the old advice changed

The rules most people learned — eight characters minimum, at least one uppercase letter, one number, one symbol, changed every ninety days — were formalised in an era when the main threat was someone guessing your password. They were a reasonable response to that threat at the time.

They have since been substantially revised. The US National Institute of Standards and Technology (NIST) publishes Special Publication 800-63B, which sets the authentication guidance that US federal agencies must follow and that much of the private sector also treats as a reference point. The current version recommends against several of the old rules specifically:

Against composition rules — no requirement for uppercase, digits or symbols, because the resulting passwords follow predictable patterns that cracking tools are built to exploit.
Against periodic rotation — forcing a change every ninety days produces predictable variations ("Summer2023" becomes "Summer2024") rather than actual security improvements.
In favour of length — an eight-character minimum, support for at least 64 characters, and allowance for all printable characters including spaces.
In favour of blocklists — checking chosen passwords against known-compromised password lists rather than enforcing composition rules.
In favour of paste — explicitly allowing paste in password fields, because blocking it breaks password managers and encourages weaker choices.
In favour of rate limiting — limiting authentication attempts as the correct defence against guessing, rather than forcing users to memorise harder passwords.

The reasoning is simple once stated: composition rules produce passwords that are hard for humans to remember and easy for computers to guess, because everyone who was forced to add a symbol added it in the same predictable place. A "complex" password like P@ssw0rd1! satisfies every traditional rule and appears in cracking dictionaries thousands of times over.

2. The real risk: reuse

The single most consequential password habit is not having a weak password. It is having the same password on multiple sites.

When a service is breached, attackers obtain a list of email addresses and password hashes. If the passwords are stored properly, the hashes take time to crack. If they are stored badly — plaintext, or a weak hash — they are readable immediately. Either way, the resulting list of credentials is then tried against other services. Email and password pairs are matched across dozens of sites automatically. This is called credential stuffing, and it works because reuse is extremely common.

The pattern that makes this dangerous: a breach at a low-value site — a forum you signed up to once, a shopping site you used years ago — gives an attacker your email and password. If you used that same combination for your email account, your bank, or your cloud storage, those accounts are now compromised as well. The attacker did not need to breach the higher-value services. They just logged in.

Verizon's annual Data Breach Investigations Report has consistently identified the use of stolen credentials as a leading initial access vector in breaches. The specific percentage varies by year and by how the categories are defined, so I am not going to quote one. The pattern itself is stable: reused passwords are one of the most reliable ways an attacker gets in, because they remove the need to exploit anything technical.

The reframe worth internalising: the goal is not one strong password. It is a different password for every account. Once you hold that, the solution becomes obvious: you cannot memorise dozens of unique passwords, so you need a tool that does. That tool is a password manager.

3. What actually makes a password strong

Two properties matter, and only two: length and randomness. Complexity — the mix of character types — is a weak proxy for randomness that became popular because it was easy to enforce in a form field.

Original diagram — complexity satisfies form rules; unpredictability is what actually resists cracking.

Cracking tools do not try every possible combination of characters. They try, in order: common passwords from breach lists, words from dictionaries, and variations of those words using the substitution rules humans are known to apply (a → @, o → 0, e → 3, s → $). A "complex" password built by a human almost always falls into one of those categories, because humans are predictable.

The practical implication is: the best password is one you did not choose by hand. Either a randomly generated string (which a password manager will create for you) or a randomly generated passphrase (four to six words, selected without meaning). Randomness is what determines whether cracking tools have to guess at scale.

How long is long enough?

The honest answer depends on what is being protected and how often the service rate-limits attempts. NIST recommends an eight-character minimum for user-chosen passwords, but that is a floor set for practicality, not a recommended target for high-value accounts.

For a random password generated by a manager, sixteen characters is a reasonable default — most managers default to sixteen or twenty, and that is fine. For a passphrase that you are choosing and memorising, the count is words, not characters: four words is the practical minimum, five or six for anything high-value. Each additional randomly chosen word multiplies the search space by the size of the wordlist.

4. Three approaches, ranked

1. Password manager (strongest, easiest)

A password manager is an app that stores your passwords in an encrypted vault, unlocked by one master password. It generates random passwords when you create an account, fills them in when you log in, and remembers them so you do not have to.

This solves the entire problem in one step: every account gets a unique random password, and you only need to remember one strong passphrase to unlock the vault. It also removes the most common path to compromise — a reused password exposed in one breach and tried everywhere else.

Password managers exist in several forms: cloud-synced apps (Bitwarden, 1Password, Dashlane), local apps that store data only on your device (KeePassXC), and the built-in managers in browsers and operating systems (iCloud Keychain, Google Password Manager, Microsoft Edge, Firefox). The built-in options are free and genuinely capable — they are a perfectly reasonable starting point. The dedicated apps offer features like password sharing, breach monitoring, and better cross-platform support, but they are refinements rather than requirements.

2. Passphrase (strongest you can memorise)

If you cannot or will not use a manager for a particular account, a randomly generated passphrase is the next best thing. Four or more words, selected from a large list without letting meaning influence the choice. The Diceware method — invented by Arnold Reinhold in 1995 and still the standard for this technique — uses a list of 7,776 short words, and each word contributes about 12.9 bits of entropy when chosen randomly.

"Without letting meaning influence the choice" is doing a lot of work in that sentence. A human choosing four words that form a memorable phrase produces a phrase with far less entropy than a random one, because the words a human would pick to make a phrase are a much smaller set than the full wordlist. A truly random four-word passphrase is strong. A human-chosen four-word phrase is weaker, and a human-chosen phrase based on a quote or lyric might be in a cracking dictionary.

3. A long, unusual password you memorise

This is the fallback for one or two accounts where the first two approaches do not work — typically a device unlock, a master password, or something you need to enter frequently enough that even a manager is inconvenient. Best constructed as: several unrelated words, a number, and something unusual, without patterns.

This approach is genuinely weaker than the first two, because human-chosen strings of any kind tend to be less random than they feel. It is worth using only where the other options do not apply.

What is not on this list, deliberately: a "complex" password with predictable substitutions, a password based on a quote or lyric, a password written on a sticky note attached to the monitor, and a password stored in an unencrypted notes app. These all fail for reasons that should be obvious by now.

5. How to actually start with a password manager

This is the section most articles skip. "Use a password manager" is easy advice to give and hard advice to act on, because the first step — moving dozens or hundreds of existing passwords into it — feels overwhelming. Here is the honest, staged approach that works.

Original diagram — a staged migration that does not require a weekend of password changing.

Step 1: Choose a manager (five minutes)

Pick one and do not overthink it. The realistic options:

Your browser's built-in manager — free, already installed, and genuinely fine for most people. Chrome, Safari, Firefox and Edge all include password managers that generate passwords, autofill, and sync across devices if you sign in. This is the lowest-friction starting point.
Your phone's built-in manager — iCloud Keychain on Apple devices, Google Password Manager on Android. Same reasoning: already there, already syncs, and increasingly integrates with passkeys.
A dedicated app — Bitwarden (free tier is generous, open source), 1Password (paid, polished), KeePassXC (free, entirely local, no cloud sync). Worth choosing if you want better cross-platform behaviour or password sharing with family.

Any of these is dramatically better than reusing passwords. The perfect-choice paralysis that stops people from starting is not worth it — you can migrate to a different manager later.

Step 2: Set a strong master password (ten minutes)

The master password is the one you actually remember. Use a passphrase — four to six random words — or a long unusual string. Write it down on a piece of paper and store it somewhere physically secure while you get used to it. Yes, written down; the risk of someone breaking into your home to steal your password note is much lower than the risk of forgetting the passphrase and losing access to every account.

If the manager supports it, enable two-factor authentication on the manager itself. That way, even someone who learns your master password cannot unlock your vault without the second factor.

Step 3: Protect your email first (thirty minutes)

This is the highest-leverage single change. Your email account is the reset path for every other account you own — if an attacker has access to your email, they can reset the password on almost anything else. Change your email password to a strong passphrase, save it in the manager, and turn on two-factor authentication.

Do this before touching anything else. It protects the majority of the risk in one action.

Step 4: Financial accounts next (an hour)

Bank accounts, payment apps, anything that stores card details. Change each password to a random one generated by the manager. Enable two-factor authentication where it is offered.

Step 5: Everything else, gradually

Do not try to change every account in one sitting. As you log into each service over the following weeks, let the manager generate a new password and save it. Most managers detect password forms automatically, so this becomes a background habit rather than a project.

If you have hundreds of accounts, this will take months. That is fine. After stage 1, the remaining risk is much smaller, and after stage 2, the financial impact of any remaining reuse is limited.

Step 6: Check for exposed passwords (fifteen minutes)

Use Have I Been Pwned (haveibeenpwned.com) — a well-known public service maintained by security researcher Troy Hunt — to see whether your email address appears in known data breaches. Some password managers check against this automatically. If an account is on the list, that password should be changed first regardless of what stage you are at.

6. What to do about existing accounts

Three practical points for the accounts you already have, which most articles do not address.

Change, do not delete. The temptation when migrating is to close old accounts to reduce the list. That is worth doing for accounts you genuinely no longer use, but do not delete accounts simply because the passwords are weak — change the password instead. Deleting an account can lose data you might want later.

Watch for accounts you have forgotten. Password managers fill this gap because they prompt you when you visit a site that is not in the vault. Over months, they will surface accounts you had genuinely forgotten existed.

Do not trust "password strength" meters. Most are heuristic and reward length and character variety without understanding predictability. A meter that calls P@ssw0rd1! "strong" is not measuring anything useful. What matters is whether the password is in a blocklist and whether it was randomly generated.

7. Passkeys: the structural fix

Passkeys are the newest and most significant change to how authentication works, and they are meaningfully different from everything above. They are the answer to "what if I just... didn't have a password at all?"

A passkey is a cryptographic credential stored on your device, unlocked by your fingerprint, face or device PIN. When you sign in, your device proves it holds the private key for that specific website's domain. There is no password to steal, no code to relay, and no secret to forget.

The property that matters most: passkeys are bound to a domain. If you are on yourbank.com, your device will only offer the passkey registered to yourbank.com. On yourbank-secure.net, the passkey simply does not appear. This makes phishing structurally impossible — there is nothing to phish, because the attacker cannot obtain a usable credential even if you try to log in on their fake site.

This connects directly to phishing, which is how most credentials are actually stolen. If you have read the guide on how to spot a phishing email, you will recognise the pattern: a convincing fake login page, a stolen password, and an account compromise. Passkeys remove that entire attack path.

Passkeys are supported by Google, Apple, Microsoft, and a growing number of banks and services. Enabling them on your email account and financial accounts is the single highest-impact security change most people can make. The FIDO Alliance, which develops the underlying standards, describes them as phishing-resistant — a specific technical claim, not a marketing one.

For a broader view of how encryption underlies all of this, the guide on what end-to-end encryption actually protects covers the parallel story: understanding what a security property really guarantees, rather than what the marketing claims it does.

Where this leaves you

Password advice has changed, and the change is worth taking seriously. Composition rules produce predictable passwords. Forced rotation produces predictable variations. What matters is length, randomness, and — above everything else — uniqueness across accounts.

A password manager solves the entire problem. You remember one strong passphrase, it generates and stores a random password for every account. The migration does not have to happen in one weekend: protect your email first, then financial accounts, then the rest as you go. Even partial migration dramatically reduces your exposure.

Passkeys go further, removing the password entirely. They are the direction the industry is moving, and enabling them on your most important accounts is worth doing as soon as the services you use support them.

None of this requires understanding cryptography. It requires accepting that you cannot memorise dozens of unique strong passwords, and using the tool that can.

Frequently asked questions

Are password managers safe?

The established ones are designed around this question. Your vault is encrypted on your device before it syncs, so the provider typically cannot read it. The main risk is not the manager being broken into — it is your master password being weak or reused elsewhere. Use a strong passphrase for the master password, enable two-factor authentication on the manager account, and it is safer than any alternative approach.

What if I forget my master password?

You will lose access to the vault unless you have set up recovery options. This is a real inconvenience, and it is the price of the provider not being able to read your data. Write your master password on paper and store it somewhere physically secure, or set up the manager's recovery options if it offers them. Do not skip this step.

Which password manager should I use?

Any established one. Your browser's built-in manager is free and genuinely capable. If you want a dedicated app, Bitwarden (free, open source), 1Password (paid, polished) and KeePassXC (free, entirely local) are widely trusted. The important thing is to start, not to choose perfectly.

Do I still need to change my password every 90 days?

No. NIST explicitly recommends against forced periodic rotation, because it produces predictable variations rather than actual security improvements. Change your password when there is a reason: a known breach, a suspicious login, or a change in who has access. Not on a schedule.

Are passphrases like "correct horse battery staple" actually secure?

Yes, if the words were chosen randomly — from a large wordlist, without letting meaning influence the choice. A randomly generated four-word passphrase has meaningful entropy. A human-chosen phrase that forms a sentence or a lyric is much weaker, because the words a human would pick to make a phrase are a far smaller set than the full wordlist. The XKCD comic is often cited without this caveat, which matters.

How long should my password be?

For a random password generated by a manager, sixteen characters is a reasonable default. For a passphrase you are choosing and memorising, four words is the practical minimum and five or six is better for high-value accounts. NIST recommends an eight-character floor for user-chosen passwords, but treats that as a minimum, not a target.

What about two-factor authentication — is it better than a strong password?

They solve different problems, and you should use both. A strong unique password protects against someone guessing or cracking your credential. Two-factor authentication protects against someone who has obtained your password — through a breach, phishing, or reuse — by requiring a second proof of identity. Passkeys are even better because they are phishing-resistant by design.

Should I use a password manager on my phone?

Yes. Both iCloud Keychain and Google Password Manager are built into the operating system and integrate with autofill across apps. If you use a dedicated manager, install its mobile app and enable autofill in your phone's settings. The mobile side is where many people accidentally fall back to reusing old passwords.

Sources and further reading: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (current revision); FIDO Alliance documentation on passkeys and WebAuthn; Have I Been Pwned (haveibeenpwned.com), maintained by Troy Hunt; Arnold Reinhold, The Diceware Passphrase Home Page (1995 onwards); Randall Munroe, XKCD #936 (the "correct horse battery staple" comic); Verizon Data Breach Investigations Report (annual; stolen credentials as a leading access vector); public documentation from Bitwarden, 1Password, KeePassXC, Apple, Google and Microsoft on their password manager implementations. No specific statistics are quoted for password reuse rates, breach sizes, or the percentage of breaches caused by credential theft, because these figures vary widely by source, methodology and year. Where a claim rests on published standards or documented behaviour, the source is named.

Featured post