Every password rule you've ever heard sounds like it was designed to make your life harder: eight characters, then twelve; a symbol, but not that symbol; change it every 90 days, but never write it down. No wonder most people give up and use their dog's name plus a birth year everywhere. The good news: modern security guidance is simpler than the old rules, and the strongest passwords can actually be the easiest to remember — if you build them the right way.
Why length beats complexity
Attackers crack passwords by guessing — not one guess at a time typed by hand, but billions per second with specialized hardware running through leaked password databases, dictionaries, and predictable patterns. What stops them isn't cleverness; it's arithmetic. Every additional character multiplies the total number of possibilities. A password of 8 characters chosen from all letters, digits and symbols has about 6 quadrillion combinations — a lot, but a modern cracking rig chews through that space in days. At 12 characters the space grows by a factor of about 8 billion, pushing the same attack into geological time. At 16 characters, forget it.
This is why the National Institute of Standards and Technology (NIST) now tells organizations to favor length over forced complexity rules, and why the famous "correct horse battery staple" insight holds up: four ordinary words strung together are both longer than a typical "complex" password and far easier for a human brain to store. Complexity still helps — a bigger alphabet per character means a bigger search space — but length is the lever that matters most, and it's the one humans are actually good at.
Method 1: The passphrase (best for your most important passwords)
Pick four or five unrelated words and join them: lantern-cactus-river-piano-92. Unrelated is the key word — avoid famous quotes, song lyrics, and phrases that appear in books, because cracking tools try those first. The reliable way to get genuinely unrelated words is to not choose them yourself: roll dice or use a random generator to pick words from a list, because humans asked to "think of a random word" produce surprisingly predictable answers (a disproportionate number of people pick "banana"). Add a number or swap in a symbol if a site insists, but the words do the heavy lifting.
Use passphrases for the handful of passwords you must type from memory: your password manager's master password, your computer login, and your primary email. That's it — everything else can be machine-generated, as we'll see below.
Method 2: The sentence trick
Invent a sentence that's true for you but appears nowhere online, then take the first letter of each word: "My first car was a green 1998 pickup with a dented tailgate" becomes Mfcwag1998pwadt. You remember a story; an attacker faces 17 characters of apparent noise. Strengthen it by keeping the digits and mixing case naturally as the sentence gives them to you. The one warning: don't build the sentence from facts on your social media profiles. If a stranger can learn it from your public posts, it isn't a secret.
Method 3: Don't remember them at all (the real answer)
Here's the part the old advice skipped: you have dozens, maybe hundreds, of accounts, and no human memory strategy scales to that. Nor should it. A password manager — built into your browser or phone, or a dedicated app like Bitwarden, 1Password, or Apple/Google's built-in managers — generates a unique, random, 16+ character password for every site and remembers them all for you. Your only jobs are choosing one great passphrase for the manager itself and turning on two-factor authentication for it.
With a manager in the picture, the workflow for a new account becomes: open a generator like our Password Generator (which creates passwords locally on your device and never transmits them), generate 16–20 characters with all character sets on, save it in the manager, and never think about it again. Each account gets a different password, so when — not if — some site you've forgotten about gets breached, the leaked password opens exactly one door, and it's a door you can close in a minute.
The habits that matter more than the password itself
- Never reuse. Credential stuffing — testing leaked passwords on other sites — is the single most common way accounts get taken over. Uniqueness beats strength.
- Turn on two-factor authentication (2FA) for email, banking, and social accounts. An authenticator app or hardware key is far stronger than SMS codes. With 2FA on, even a stolen password isn't enough.
- Protect the email account like it's the vault — because it is. Password resets for nearly everything flow through it.
- Change a password when there's a reason — a breach notice, a device lost, a hint you shared it — not because a calendar says so. Forced rotation mostly produces weaker passwords with a number bumped at the end.
- Beware the page asking for the password. Phishing defeats strong passwords trivially: the fake login page just hands your perfect password to a criminal. Check the domain before typing, every time.
A quick self-audit
Ask yourself three questions. One: if your most-used password leaked today, how many accounts would fall? If the answer is more than one, fixing that is your highest-value hour of security work this year. Two: do you know your email password from memory, and is it unique and long? Three: is 2FA on for email and banking? Get those three right and you're ahead of the overwhelming majority of account-takeover victims — not because you outsmarted anyone, but because you made yourself an unprofitable target.
Strong passwords you can remember aren't a contradiction. They're a passphrase, a sentence, and a password manager — and about twenty minutes of setup, once.
Frequently asked questions
How long should my password actually be?
At least 12 characters for ordinary accounts, 16 or more for important ones, and a 4–5 word passphrase for your password manager. With a manager doing the remembering, longer is free — take it.
Are passphrases really stronger than complex passwords?
Yes, when the words are randomly chosen and unrelated. Four random words (about 28 characters with separators) contain more entropy than most 10-character symbol soups — and you can actually type them correctly on the first try.
Is it safe to let my browser save passwords?
Modern browser password managers are encrypted and vastly better than reuse. A dedicated manager adds cross-device sync, breach alerts, and sharing controls. Either beats a notebook or a spreadsheet — and both beat "Password123" everywhere.
What about the password I generated here — where is it stored?
Nowhere. GenKit's generator works entirely on your device and keeps no copy; copy your password into your password manager immediately, because once the tab closes it's unrecoverable.