How to Make Strong Passwords You Can Actually Remember

Everyone knows they should use strong passwords. Almost no one does. The reason isn’t laziness — it’s a mismatch between what security guides tell you to do (“use unique, complex passwords everywhere”) and what your brain can actually hold.

This is a practical guide to passwords in 2026: what makes them strong, why the old advice is wrong, and three approaches that actually work in the real world.

What actually makes a password strong

A password’s job is to survive an attacker who is guessing it as fast as possible. Modern attackers use graphics cards that can try billions of passwords per second against a stolen hash. The two things that matter for surviving that:

Length. Every extra character multiplies the number of possible passwords. An 8-character random password takes hours to crack. A 16-character random password takes centuries. Length is the single most important factor.
Unpredictability. The password should not appear on any leaked-passwords list, follow a common pattern (Password123!), or be based on personal details (your dog’s name, your birth year).

Notice what’s not on that list: symbols, mixed case, or numbers per se. A random 16-character password made entirely of lowercase letters is stronger than an 8-character password full of symbols. The industry moved on from “must-contain-a-symbol” rules years ago — they were security theatre that produced predictable passwords like P@ssw0rd!.

The old advice was wrong

For twenty years websites demanded 8-character passwords with at least one uppercase, one digit and one symbol. The result was universal: everyone appended a 1! to a capitalised word. Summer2024! is technically compliant and utterly predictable.

In 2017, NIST — the US body that sets password standards — updated their guidance. The current recommendation:

Length: at least 8 characters, but preferably 16+.
Allow any characters, including spaces and Unicode.
Do not force periodic changes.
Do not require complex composition rules.
Check every new password against known-breached password lists.

In short: longer is better, and don’t force people into predictable patterns.

Approach 1: passphrases

A passphrase is four to six random unrelated words in a row. Example: correct-horse-battery-staple. This is easier to remember than any random character string of equivalent strength, and much stronger than a typical 8-character password.

Rules:

The words must be truly random. Don’t pick words from a song.
Use at least four words. Five is safer.
Separator characters (hyphens, dots, spaces) help both memory and security.

Best for: passwords you have to type from memory, like your device unlock or password manager master password.

Approach 2: random strings from a password manager

For every other password on your life, don’t remember them at all. Use a password manager to generate and store a unique 20-character random string per site.

Good password managers (1Password, Bitwarden, Apple’s Passwords app, KeePass) do three things:

Generate random passwords on demand.
Store them encrypted, unlocked by your one master passphrase.
Auto-fill on websites and apps.

The security tradeoff is your master password. Make it a five- or six-word passphrase, never used anywhere else. Everything else is auto-generated and forgettable.

Need a strong random password right now? Zevqi’s Password Generator creates one in your browser, with adjustable length and character-set toggles. Nothing is sent to a server.

Approach 3: a personal formula (only as a fallback)

If a password manager isn’t an option — some workplaces block them, or you don’t trust cloud storage — a personal formula can help: a stable base plus a site-specific twist.

Example structure:

[Passphrase]-[SiteAbbreviation][YearRegistered]
gives:
correct-horse-battery-staple-amz2023
correct-horse-battery-staple-git2021

This is a compromise — a leaked password from one site reveals the pattern. Better than reusing identical passwords, worse than a password manager. Use as a temporary bridge, not a long-term strategy.

What to do this weekend

Pick a password manager. Bitwarden is free and audited. 1Password is more polished. Apple Passwords is built in on iOS and Mac.
Set your master passphrase — 5 truly random words, memorised.
Rotate your five most important passwords (email, bank, main social, work SSO, password manager itself) to unique 20-character random strings.
Enable two-factor authentication on those five accounts. This matters more than password strength for most attacks in the wild.
Over the next month, rotate remaining accounts as you log in to them.

Two-factor authentication is doing more heavy lifting than your password

Most account breaches don’t come from cracked passwords. They come from reused passwords leaked in another site’s breach and replayed. Two-factor authentication (TOTP codes from an app, or a hardware key) blocks that entire class of attack.

SMS-based 2FA is better than none, but weaker than a code app because phone numbers can be hijacked. Prefer app-based (Authy, Google Authenticator, 1Password’s built-in TOTP) or hardware keys (YubiKey) for accounts that support them.

Common myths worth dropping

“I need to change my password every 90 days.” No — NIST explicitly discourages this. It leads to slightly-modified predictable passwords.
“Symbols make passwords stronger.” Only marginally. Length matters more than any single character type.
“Password managers are risky because they’re a single point of failure.” They’re a much smaller risk than reusing weak passwords across dozens of sites. Reputable managers are audited and use zero-knowledge encryption.

Generate one now

The Password Generator creates cryptographically strong passwords in your browser — nothing crosses the network. Choose length, character sets, and whether to exclude ambiguous characters (I, l, 1, O, 0) that are hard to read aloud.

The bottom line

Length beats complexity. A password manager plus five strong passphrases plus 2FA on the five accounts that matter — that’s the setup that actually protects you, and it’s achievable in a single Saturday afternoon.