Passwords That Are Strong and Easy to Remember
Long beats complicated. Learn the three-random-words method, why password managers are worth it, and 5 steps to clean up your accounts this weekend.
Most of us were taught to make passwords complicated: capital letters, numbers, symbols. The result is passwords like `P@ssw0rd1!` that are hard for people to remember but easy for computers to guess. Modern advice is simpler: make passwords long and unique.
How passwords get stolen
- Data breaches. A website you use is hacked and your password leaks. If you used it on other sites, attackers try it there. This is called credential stuffing.
- Guessing. Computers can try billions of guesses, starting with common words and patterns.
- Phishing. You are tricked into typing your password on a fake page.
The three random words method
The UK National Cyber Security Centre recommends joining three random words to create a password. For example `coffee-train-purple`. It is long enough to resist guessing and easy to picture and remember.
- Use words that are unrelated. Do not use song lyrics, quotes, or your family names.
- Add numbers or symbols if a site demands them, but length is what counts.
Let a password manager do the rest
You cannot remember a unique strong password for dozens of sites. A password manager is an app that stores them securely behind one master password. It creates random passwords, fills them in for you, and warns you about reused or leaked passwords.
Clean up your accounts in 5 steps
Choose a password manager
Pick a reputable one. Many phones and browsers have a built-in manager that works well for starting.
Create a strong master password
Use a long three-word phrase and never reuse it anywhere. Write it on paper and keep it safe at home until you remember it.
Fix the important accounts first
Email, banking, shopping, and social media. Your email is the most important, since it can reset all other passwords.
Replace reused passwords
Let the manager generate a new random password for each account.
Turn on two-step verification
Add a second check, such as an authenticator app, for your key accounts.
What most people miss
- Changing passwords regularly is no longer advised by many security bodies unless you suspect a breach. Forced frequent changes lead people to choose weaker patterns.
- Never share one-time passwords (OTP) with anyone, including callers claiming to be from your bank.
- Check if your email appeared in a breach. The free service Have I Been Pwned lets you check.
