Most people know they should use strong passwords, yet “123456”, “password” and pet names still top the lists of most-used passwords every year. The problem is not laziness — it is that strong passwords feel impossible to remember. The good news is that you do not need to memorise dozens of random strings. With the right system, you only need to remember a few.
What Makes a Password Strong?
Password strength comes down to how hard it is for a computer to guess. Attackers use automated tools that try millions of combinations per second, starting with common words, leaked passwords and predictable patterns like “Summer2026!”. A strong password has three qualities:
- Length: at least 12–16 characters. Length matters more than complexity.
- Unpredictability: no names, birthdays, keyboard patterns (qwerty) or simple substitutions (p@ssw0rd).
- Uniqueness: used for one account only. If one site is breached, the others stay safe.
The Passphrase Method
The easiest way to get a long, strong password you can remember is a passphrase: four or more random, unrelated words strung together. For example: copper-lantern-river-biscuit. It is 28 characters long, far harder to crack than “Tr0ub4dor&3”, and much easier to recall because your brain is good at remembering images.
Tips for a good passphrase:
- Choose words truly at random — open a dictionary or use a dice-based word list rather than picking favourite words.
- Avoid famous phrases, song lines or quotes; attackers include these in their word lists.
- Add a number or symbol between words if a site requires it.
- Picture a silly scene that links the words — a copper lantern floating down a river next to a biscuit.
Let a Password Manager Do the Heavy Lifting
Even the best memory cannot hold 80 unique passphrases. A password manager solves this. It stores all your passwords in an encrypted vault, generates strong random passwords for every new account and fills them in automatically. You only need to remember one strong master passphrase.
Most modern browsers and phones include a built-in password manager, and there are many dedicated apps with free and paid plans. When choosing one, look for end-to-end encryption, support for all your devices, and a good track record on security.
Which Passwords Should You Memorise?
With a password manager in place, you only need to memorise a handful of passwords:
- Your password manager’s master passphrase
- Your main email account (it is used to reset everything else)
- Your computer or phone login
Make each of these a unique passphrase of at least five words.
Turn On Two-Factor Authentication
A strong password is your first lock; two-factor authentication (2FA) is the second. With 2FA turned on, logging in requires something you know (your password) plus something you have (a code from an authenticator app, a security key or a text message). Even if your password leaks, an attacker cannot get in without that second factor.
Authenticator apps and hardware security keys are more secure than SMS codes, but any 2FA is far better than none. Start with your email, banking and social media accounts. Where available, passkeys — which let you sign in with your fingerprint, face or device PIN — are an even simpler and phishing-resistant option.
Common Password Mistakes to Avoid
- Reusing the same password with small changes (Password1, Password2…)
- Writing passwords on sticky notes near your computer
- Sharing passwords over text or email
- Using personal details found on your social media profiles
- Ignoring breach alerts — if a service tells you it was breached, change that password immediately
Your 15-Minute Action Plan
Security does not have to be overwhelming. Today, set up a password manager, create a new passphrase for your email account and turn on two-factor authentication there. Next week, update your banking and shopping accounts. Over a month, let your password manager replace every old, reused password. Small steps add up to a much safer digital life.