Most people build passwords the same anxious way: a capital letter, a favorite word, and a “1!” tacked on the end because a website demanded it. It feels secure. It is not. A computer can churn through that pattern faster than you can read this sentence.
The good news is that a genuinely strong password is not harder to make, just made differently. Once you learn the method below, you can produce a password no one will crack in about ten seconds, and remember the handful you actually need to type.
Key takeaways
- Length beats complexity. A long password is far stronger than a short one full of symbols.
- Random words strung together are both hard to crack and easy to remember.
- Every account needs its own password, which is why a password manager does the remembering for you.
- You only need to memorize two or three passwords by hand. The rest live in the manager.
Why length matters more than symbols
Cracking software guesses billions of combinations per second. What slows it down is not weird characters; it is the sheer number of possibilities, and length adds possibilities faster than anything else.
A short password like “P@ss1!” has eight characters and a predictable shape, so it falls quickly. A long password of five random words has dozens of characters and no pattern to exploit, so it holds up for a very long time.
This is why the old advice to sprinkle in symbols was always a bit of a distraction. Symbols help a little, but adding four more characters helps enormously. Length is the lever worth pulling.
Security guidance from major standards bodies now recommends length over forced complexity. The rule “at least 12 to 16 characters” protects you far better than “must contain a symbol and a number.”
The random-words method, step by step
This is the technique I teach everyone, because it produces strong passwords a human can actually recall. It relies on unrelated words, not a memorable phrase.
Step one: pick four or five unrelated words
Choose words that have nothing to do with each other, like “copper otter lantern drift piano.” The lack of connection is the point. A real sentence is guessable; random nouns are not.
Do not use words tied to you personally, such as your pet’s name or your street. Those show up in the details a scammer can find about you online.
Step two: add a twist
To satisfy sites that demand a number or symbol, glue a small twist onto your words: “copper-otter-lantern-drift7piano.” The hyphens and the number keep picky websites happy without weakening anything.
Keep the twist consistent enough to remember but do not reuse the same words anywhere else. For a deeper look at this approach, our dedicated guide to building passphrases walks through it with more examples.
Step three: make each one unique
Every account gets its own set of words. This is the rule people resist most, and it is the one that saves them. If one site is breached, a unique password means the damage stops there.
Never adapt one base password by changing a single character per site, like “otterFacebook” and “otterGmail.” Attackers know that trick and test for it automatically. Each password must be genuinely different.
Let a manager remember the rest
Here is the honest truth: you cannot memorize 80 unique long passwords, and you should not try. A password manager remembers them for you and fills them in automatically.
You memorize exactly two or three passwords by hand: the one that unlocks your password manager, the one for your primary email, and perhaps your device login. The manager handles everything else and can generate random passwords stronger than any human invents.
| Password type | Example approach | Do you memorize it? |
|---|---|---|
| Password manager master | Five random words you type daily | Yes |
| Primary email | Different five random words | Yes |
| Every other account | Random string the manager generates | No, the manager fills it |
That split is the whole trick. A couple of strong passwords in your head, and hundreds more locked in a tool that never forgets. If this is new, start with our overview of password security basics to see how the pieces connect.
Common traps that quietly weaken you
Even careful people fall into a few patterns that undo their good work. A predictable shape, like a capital letter first and a number last, is one attackers assume by default.
Substituting numbers for letters, like “P4ssw0rd,” feels clever but fools no one, since cracking tools test those swaps automatically. And basing a password on public facts about you, like a birth year or a team name, hands attackers a head start.
When I reviewed a friend’s logins, almost every one was a single base word with a site name bolted on. It took an afternoon to fix, and she has not had a scare since. For the full list of habits to avoid, see our rundown of common password mistakes and their easy fixes.
Testing your new passwords
You do not have to guess whether a password is strong. A few plain checks tell you fast.
First, count the characters. Aim for at least 16 for anything important. Second, ask whether any part of it relates to you or to the website. If so, replace that part with something random.
Third, check whether an old password of yours has turned up in a known breach. The free, well-respected service at haveibeenpwned.com lets you look up an email address safely and flags accounts that need a new password today.
Your afternoon checklist
- Set up a password manager if you do not already have one.
- Create a strong master password from five unrelated random words.
- Make a different five-word password for your primary email.
- Let the manager generate unique random passwords for every other account.
- Replace any password that is short, reused, or based on personal facts.
- Check your email address on Have I Been Pwned for known breaches.
- Turn on two-factor authentication for email and money accounts.
- Store your two hand-typed passwords somewhere safe offline, not on a sticky note.
Strong passwords stopped being about clever tricks a long time ago; they are about length, randomness, and never repeating yourself. Give the random-words method one honest try this afternoon, and it will feel obvious ever after.
