How to Create a Password You Can Remember and Attackers Cannot Guess

Think about how many accounts you have: email, mobile money, Facebook, WhatsApp backup, school or work portals, online shops. Now think about how many different passwords you use for them. If the answer is "one, with small changes", you are in the majority, and you are also at risk.

Most accounts are not hacked by movie-style tricks. They are opened by people who simply try passwords that have leaked from other websites, or passwords that are easy to guess. The good news is that you can make this very difficult for them without memorising a dozen strange codes.

Why short and clever is a weak idea

Many people think a password like "P@ssw0rd1!" is strong because it has a capital letter, a number and symbols. But attackers know these tricks. Swapping "a" for "@" or adding "1" at the end is one of the first things their tools try. Passwords based on a name, a birthday, a football club or a phone number are also easy to guess, especially if your social media shows these details.

Length is what matters most. Every extra character multiplies the number of guesses an attacker needs. A long password made of random words is both stronger and easier to remember than a short one filled with symbols.

Use a passphrase

A passphrase is several unrelated words joined together, for example four or five random words. The key is randomness. A famous quote, a line from a song or a sentence about yourself is much weaker than words picked without any link between them.

One simple method is to pick words you do not normally put together, add a separator and a number you will remember, and build a mental picture to hold them in your head. Aim for at least fourteen to sixteen characters, and longer for important accounts such as your main email.

What to avoid

Your name, your children's names, your birth year or your phone number.

Common words and patterns such as "password", "123456", "qwerty" or "iloveyou".

The same password on more than one account. When one website leaks it, attackers try it everywhere else.

Writing passwords on a sticky note beside your computer or sharing them in chat messages.

Use a password manager

Nobody can remember dozens of long, unique passphrases. A password manager does it for you. It stores all your passwords in an encrypted vault, locked by one strong master passphrase, and fills them in when you log in. You only need to remember the master one, so make it long, make it unique and never use it anywhere else.

Several trusted password managers exist, and some phones and browsers have built-in ones that are good enough for many people. Choose one from a well-known provider, keep it updated and back up your recovery details.

Turn on two-step verification

Two-step verification, also called two-factor authentication, asks for a second proof when you sign in, usually a code from an app or a message. Even if someone learns your password, they cannot get in without that second step. Turn it on first for your email, because email can reset every other account, then for mobile money, social media and cloud storage. An authenticator app is generally safer than text messages, but any second step is better than none.

Check whether your details have leaked

Websites that track data breaches let you type in your email address and see if it appeared in a known leak. If it did, change that password right away, and change it on any other account where you used the same one.

What to do if an account is hacked

Sign in from a safe device and change the password immediately. Log out of all other devices if the service lets you. Turn on two-step verification. Check your recovery email and phone number in case the attacker changed them. Warn your contacts that messages from your account may be scams. And change the password of any other account that shared the same password.

Try before you trust

You can test how guessable a password is with the password checker on this site, under Learn then Free tools. It runs entirely in your browser, so what you type never leaves your device. Still, as a habit, test a similar password rather than the exact one you use for your bank.

Good password habits take an afternoon to set up and then protect you for years. Start with your email today.