Quick answer: The easiest strong password you can remember is a long passphrase: several random, unrelated words strung together. Length matters more than fancy symbols. Memorize one or two of these, and let a password manager create and remember everything else.
What makes a password strong?
Three things. The U.S. cybersecurity agency CISA says a strong password is long, random, and unique, and it needs all three. A short password with a few symbols doesn’t make the cut.
“Unique” means one password per account. If you reuse one and a single site gets hacked, every other account that shares it is at risk. “Random” means nobody could guess it from your life. Birthdays, pet names, and favorite teams are the first things a guesser tries.
How long should your password be?
Aim for at least 16 characters. That’s CISA’s advice on its password tip sheet. NIST, the federal standards agency, sets a floor for websites and apps: at least 15 characters when a password is the only thing protecting an account. It allows a shorter minimum of 8 when a second step, like a text code or an app prompt, is also required. In plain terms, 15 or 16 is the number to beat. Longer is fine, and you can use spaces.
How do you make a strong password you can remember?
Use a passphrase. CISA suggests a memorable phrase made of five to seven unrelated words, then a creative spelling tweak to make it even stronger. Your brain can hold words much more easily than random characters like cXmn&ZK65*rf.
Here’s a made-up example. Pick five words that have nothing to do with each other: teacup, walrus, ladder, sunburn, dime. Join them: teacup-walrus-ladder-sunburn-dime. Then add one tweak, like a number in place of a letter: teacup-walrus-ladd3r-sunburn-dime.
Don’t use this exact one, since it’s now public. Build your own.
Two tips make it stick:
- Pick words at random. Open a book or a dictionary to any page and choose a word. Words you choose on purpose tend to relate to you, which makes them guessable.
- Make a picture. Imagine a walrus on a ladder with a sunburn. A silly image is easier to remember than a list.
Type it from memory a few times on day one. After a week of daily use, it’ll feel automatic.
What tricks should you skip?
Some old advice is outdated. Here’s what to avoid and what to do instead:
| Old trick | Why it falls short | Do this instead |
| Swapping letters for look-alike numbers (P4ssw0rd) | Guessers expect these swaps. NIST’s guidance specifically aims to discourage trivial changes to weak passwords. | Use a long phrase of random words. |
| Adding a number and symbol to one word (Summer2026!) | It’s still one common word. NIST says sites should reject common words, the site’s own name, and the username. | Use several unrelated words. |
| Using a famous line or lyric | Common phrases are easier to guess. | Make up your own odd combination. |
| Using personal details | A guesser who knows you can try them. | Choose words with no link to your life. |
| Changing the number every few months (Dog1, Dog2) | It’s a trivial change, so it adds little. | Change a password only if you suspect it was exposed. |
You may have heard you must change passwords often. NIST tells websites not to require periodic password changes. It says to force a change only if there’s evidence a password has been compromised.
Do you still need to remember passwords if you use a password manager?
Just one. CISA says that with a password manager, you only need to remember the one strong password that unlocks the manager. A password manager creates, stores, and fills in long, random passwords for every account. CISA also says managers can flag weak or reused passwords. NIST adds that password managers have been shown to make people more likely to choose stronger passwords, especially when the manager includes a generator.
You may already have one built in:
- iPhone: Apple’s Passwords app. When you enter a new account name on a supported website or app, your iPhone suggests a unique, complex password. Apple says Passwords also alerts you to weak, reused, or leaked passwords. To turn on AutoFill, go to Settings, then General, then AutoFill & Passwords. See Apple’s guide.
- Android and Chrome: Google Password Manager. Android can suggest and save a strong password when you tap a password field on a new account, and Chrome can do the same on websites. Google says it only suggests strong passwords when saving them to your Google Account. See Google’s guide.
You can also use a separate password manager app. CISA suggests looking at reviews from trusted sources, like Consumer Reports, to choose one.
Which passwords should you memorize?
Keep it to a short list:
- Your password manager’s main password. This is the one that unlocks everything else.
- Your phone’s passcode. You type it many times a day, so it’s already memorized.
- Your main email password. Many accounts let you reset a password by email, so whoever gets into your email can reach the rest. This is general advice and not a rule.
Everything else can live in the manager. You never need to see those passwords, let alone remember them.
Step-by-step: what to do
- Choose five random, unrelated words.
- Join them with spaces, hyphens, or none.
- Add one spelling tweak, such as a number in place of a letter.
- Check that it’s at least 16 characters long.
- Picture a silly scene that uses all five words.
- Type the password from memory three times.
- Use it as the main password for your password manager.
- Let the manager create a new, unique password for each account.
- Replace your old reused passwords, starting with email and banking.
- Never use the password anywhere else, and never share it.
Common mistakes to avoid
- Reusing one “good” password on many sites.
- Using personal details like your birthday, pet’s name, or address.
- Picking a quote or lyric from a song.
- Making tiny changes to an old password, such as adding a 1 at the end.
- Writing your passwords on sticky notes. CISA says to use a password manager instead.
- Saving the master password in a note on the same phone.
Frequently asked questions
How long should a strong password be? At least 16 characters is CISA’s advice. NIST sets a 15-character floor for passwords that stand alone. Longer is better, and a passphrase makes length easy.
Do I still need a strong password if I use two-factor authentication? Yes. Two-factor authentication adds a second step, but your password is still the first layer. NIST lets sites accept shorter passwords when a second step is also required, but a long, unique password is still the safer choice.
Should I change my passwords regularly? Not on a schedule. NIST tells websites not to force regular changes and to require one only when a password may be compromised. Change a password right away if you think it was exposed, or if you reused it on a site that was hacked.
Final thoughts
Memorize one long passphrase, and let a password manager remember the rest.