How do you create a strong password you can still remember?

Your email password protects more than your inbox. If someone gets in, they may be able to request password resets for your shopping, social media or other accounts. Yet a password that is hard for you to remember often ends up being reused everywhere or written in a place anyone can see.

A practical answer is to use a long, unique password for each account and let a trusted password manager remember most of them. For the few passwords you need to remember, consider a long passphrase made from unrelated words. CISA recommends at least 16 characters, randomness and a different password for each account.

Why length and uniqueness matter

A short password gives an attacker fewer possibilities to try. A longer one generally gives you more room to make guessing difficult. But length alone is not enough if the password is a familiar phrase, your name with a birthday added, or something you have used on several websites.

Reusing a password creates a chain problem. If one service suffers a breach and your login details are exposed, someone may try the same combination on your email or other accounts. A unique password limits the damage to the account where it was exposed.

Start with the accounts that can unlock the rest: your main email, password manager and any account connected to payments. Then work through social media, shopping and other services. You do not need to change every password in one sitting, but you do need a plan that avoids reusing the new ones.

Option 1: Let a password manager create one

A password manager stores your login details in a protected vault and can generate long, random passwords. Many phones and browsers include one; you can also use a reputable separate manager. Check how the service protects the vault, how it handles recovery and whether it works on the devices you use.

When you create or change a password:

1. Open the genuine app or type the website address yourself.
2. Go to the account’s password or security settings.
3. Use the password manager’s generator to create a long, random password that the site accepts.
4. Save the new login in the manager and confirm that the account update succeeded.
5. Sign in again if the service asks you to verify the change.

The manager can fill the correct password when you return, so you do not need to memorise a different random string for every account. Protect the manager itself with a strong, unique master password and turn on an additional sign-in method if it offers one.

Do not assume every password manager can recover your master password. Read its recovery instructions before you depend on it, and store any recovery key safely. If you lose both the master password and all available recovery options, you could lose access to the vault.

Option 2: Make a memorable passphrase

A passphrase is a longer password made from several words. Choose unrelated words that do not describe you, and use enough of them to meet the service’s rules. Length and unpredictability matter more than turning a familiar saying into something that merely looks complicated.

For illustration, imagine combining unrelated items such as a plant, a household object, a place and a sound. Do not use an example published in an article as your actual password. Choose your own private combination, and avoid lyrics, Bible verses, football chants and other phrases someone could look up.

A passphrase can be useful for the password manager’s master password because you may need to type it yourself. It should still be unique. Do not use the same phrase for your email and the vault, even if both services allow it.

Some websites limit length or require specific characters. Follow their rules without falling back on a predictable pattern such as adding `123` to the end of your name. If a site has unusually restrictive rules, make the strongest unique password it allows and use an additional sign-in method where available.

Passwords that look strong but are easy to guess

A password can contain capital letters and numbers and still be predictable. These are poor choices:

• Your name, business name or username with your birth year.
• Your phone number, vehicle number or other information people can find.
• A common word with `123` added.
• The same password with the website name changed at the end.
• A password copied from a video, article or friend’s suggestion.

Do not post even part of a real password online to ask whether it is strong. If a password has been exposed or shared with someone you no longer trust, replace it. Changing only one character may not be enough if the rest is predictable.

Turn on two-step verification

A strong password is important, but it is not the only protection your account needs. Two-step verification adds another check when you sign in. Depending on the service, that may be a prompt on a trusted device, an authenticator app, a security key or a text message code.

Choose the strongest practical method the service offers and set up recovery options before you need them. A passkey may also be available as a separate sign-in method. Follow the account provider’s instructions, because the steps and available options vary.

Never share a one-time code with a caller or person in a chat. A scammer can know your name and still be trying to enter your account. If a sign-in prompt appears when you are not trying to log in, do not approve it. Open the account’s security page yourself and review recent activity.

Where should you keep a password?

A trusted password manager is usually more practical than saving passwords in an unprotected note or sending them to yourself in a chat. Lock the phone or computer that has access to the manager, and avoid leaving an unlocked device with someone you do not trust.

If you must write a recovery code or a master password down, keep it in a secure place away from your device and away from people who should not access the account. Do not photograph the note and upload it to an account protected by that same password. Consider how you would retrieve it if your phone is lost.

Be cautious on shared computers. Avoid saving passwords in a browser you do not control, sign out when finished and check that the account has not been left open. On a borrowed device, do not assume deleting browser history removes every saved login.

What if you think a password has leaked?

Open the real service directly, not a link in a message claiming that your account is in danger. Change the affected password to a new, unique one. If you reused the old password elsewhere, change those accounts too, starting with email and financial services. Review recent sign-ins and recovery details, and turn on two-step verification.

For a Google account, follow Google’s compromised account guidance. If you cannot sign in, use the official recovery page and answer its questions as accurately as you can. Your bank or other provider has its own process; contact it through a number or app you already know is genuine.

For your home connection, our guide to securing your Wi-Fi explains how to protect both the wireless password and the router settings.

A good password does not need to be something you struggle to type every day. Make the important ones long and unique, use a reliable manager for the rest, and keep your recovery options up to date.