Home › Guides › Strong Passwords
Here's the password dilemma in one sentence: anything you can easily remember, a computer can easily guess — and anything a computer can't guess, you can't remember. This guide is about escaping that trap. The answer isn't a better memory. It's a better system.
Start with an uncomfortable truth: the passwords humans invent follow patterns, and patterns are what password-cracking software eats for breakfast. When millions of real passwords from data breaches are analyzed, the same habits appear again and again. A dictionary word or a name. A capital letter at the start. A couple of digits at the end — very often a year, or "1", or "123". A single symbol, usually an exclamation mark, in the final position. "Fluffy2024!" feels personal and unpredictable. To a cracking program that has studied millions of passwords exactly like it, it's a template with two blanks to fill in, and it will fill them in seconds.
The second problem is reuse. When a minor website you've forgotten you joined gets breached — and breaches now number in the thousands — attackers take the leaked email-and-password pairs and automatically try them on banks, email providers and social networks. This is called credential stuffing, and it works because so many people use the same password, or an obvious cousin of it, everywhere. The strength of your password matters less than its uniqueness: a mediocre password used once is safer than a brilliant one used on forty sites, because the brilliant one eventually leaks from the weakest site holding it.
For the small number of passwords you genuinely must memorize — your password manager's master password, your computer login, your phone — there's a technique that gives you machine-level randomness in a form human memory can actually hold: the passphrase. Instead of a mangled word, you take several whole words chosen truly at random and string them together.
The best-known version is the Diceware method: roll dice to pick words from a published list of 7,776 words. Each word adds about 12.9 bits of strength. Five words — something like cleft apricot turnip vessel embargo — gives you roughly 65 bits, which at ten billion guesses per second would take decades of dedicated offline cracking on average. Add a sixth word and you're at about 77 bits, where the same attack stretches into hundreds of thousands of years. And yet most people can memorize five or six random words with a silly mental picture — an apricot balanced on a turnip-shaped boat, say — far more easily than "xK9$mQ2!vL8p". You can also roll dice or use any truly random method; what matters is that the words are chosen by chance, not by you picking ones that "sound good together", which quietly reintroduces the patterns you're trying to escape.
A few practical touches: separate the words with spaces or hyphens if the site allows; add a capital or a digit if a stubborn password policy demands one; and never use a famous quotation, song lyric or the example passphrases from articles like this one — attackers' wordlists include them.
Here's the part people resist and then, once converted, never go back on: you are not supposed to remember your sixty account passwords at all. A password manager — Bitwarden, 1Password, KeePass, or the ones built into your browser and phone — stores a different, long, fully random password for every site, encrypted behind the one master passphrase you memorized using the method above. Signing in becomes clicking a suggested fill-in rather than an act of recall.
This flips the whole problem. Instead of one human-grade password stretched across your entire digital life, every account gets something like the output of our password generator: sixteen-plus characters of genuine randomness that you never type, never see and couldn't repeat if asked. If one site leaks, exactly one account is affected, and changing it takes a minute. Set the manager up on your phone as well as your computer, protect the account with two-factor authentication, and keep a written copy of the master passphrase somewhere physically secure — a sealed envelope at home — as your last-resort recovery.
Stop storing passwords in a notes app, a spreadsheet or photos of sticky notes — none of those are encrypted, and most sync quietly to the cloud. Stop texting passwords to yourself or family members; shared accounts get shared passphrases through the manager's sharing feature instead. Stop trusting "security questions" — your mother's maiden name and first school are researchable facts, so if a site forces answers, treat them as extra passwords: invent random answers and store them in your manager. And stop putting off the email account. Your inbox is the skeleton key to everything, because every "forgot password" link lands there. Give it your longest passphrase, 2FA, and five minutes of attention before anything else.
Do those things and you've done more for your security than any single clever password ever could. The system — one memorable passphrase, a manager full of random ones, 2FA on the crown jewels — is boring, and that's precisely why it works.
Put it into practice: generate your next account password with the free ToolNova Password Generator — 16+ characters, all character sets on, created on your own device and never sent anywhere. Then read why randomness beats cleverness on the generator page itself.