How to create strong passwords you can actually remember
Reusing one password everywhere is the most common way accounts get hacked. When one website leaks it, attackers try it on your email and bank.
The simple system
- Use a password manager: it creates and remembers a unique password for every site
- Make one long passphrase you remember for the manager itself, like four unrelated words
- Turn on two-step verification for email, banking and social accounts
Free options
Google Password Manager and iCloud Keychain are built into phones and browsers. Bitwarden has a free plan that works across devices.
Start small: move just your email password to a password manager today and turn on two-step verification. Your email resets everything else, so protecting it protects the rest.
Why reused passwords are the real danger
Big websites get hacked from time to time and lists of emails and passwords leak online. Attackers then try those same combinations on email, banking and shopping sites automatically. If you used the same password everywhere, one leak opens every door. A unique password for each account stops this chain reaction.
What a strong password looks like
Length beats complexity. A passphrase of four or five random, unrelated words is long, hard to guess and easy to remember, for example a mix like river-pencil-mango-orbit. Avoid names, birthdays, phone numbers, cricket teams and keyboard patterns such as qwerty or 123456.
Setting up a password manager
- Choose one: Google Password Manager, iCloud Keychain or a cross-platform app like Bitwarden
- Create one strong master passphrase and write it down somewhere safe at home
- Turn on two-step verification for the password manager account itself
- As you log in to each site, let it save the password
- Over a few weeks, change weak or reused passwords starting with email and banking
Check if your accounts were leaked
Google Password Manager and Apple's Passwords app warn you about leaked or reused passwords. The independent site Have I Been Pwned lets you check whether your email appeared in known data breaches. If it did, change that password and any place you reused it.
Frequently asked questions
Is it safe to store all passwords in one place? A reputable password manager with a strong master passphrase and two-step verification is far safer than reusing passwords or writing them in a phone note.
How often should I change passwords? Change them when there is a reason, such as a breach or suspicious activity. Forcing frequent changes often leads to weaker passwords.
Start with your email account today. Whoever controls your email can reset almost everything else.
