The good news is that you do not need a clever system. You need a source of randomness and somewhere safe to keep the result. This how-to is part of our password basics guide, and it should take about ten minutes to try.
- STEP 01Make it random
Let a generator choose, or roll dice to pick words.
- STEP 02Make it long
Aim for 16 or more characters, or five or more random words.
- STEP 03Make it unique
One password for one account, never reused anywhere.
Step 1: Work out which passwords you must remember
Most people only need to memorize a few:
- The login for your phone or computer.
- The master password for your password manager.
- Possibly your main email account.
Everything else can be stored in a password manager, which fills them in for you. This matters because it reduces an impossible job, memorizing hundreds of passwords, to a job you can actually do.
Step 2: For everything else, use a generator
Open your password manager's generator, or the suggestion your browser offers when you sign up for something. Choose these settings:
- Length: 20 characters.
- All character types switched on.
- Save it to the matching account.
You will never need to read that password. Your manager fills it in, so it can look as ugly as it likes.
Step 3: For passwords you must remember, roll dice
For the handful of secrets you carry in your head, random words are the best tool. The classic method uses ordinary dice and a printed list of 7,776 words:
- Print or open the EFF long word list, ideally offline.
- Roll five dice and read the numbers in order, such as 4-1-6-3-2.
- Find that number on the list and write down the word beside it.
- Repeat until you have five or six words. Use six for your password manager.
- Join them with spaces or hyphens.
Most password managers can also create a passphrase of random words for you, which saves time. Our guide on passwords versus passphrases explains why this works.
Step 4: Practise it
A new passphrase feels strange for a few days. To make it stick:
- Keep a paper copy in a private place at first, then decide if you still need it.
- Type it from memory once a day for a week.
- Picture a silly scene that connects the words in order.
If the password is for a manager, keep a written backup somewhere safe for good. Losing the master password can mean losing everything inside.
What to avoid
| Avoid | Why |
|---|---|
| Names, birthdays, pets, teams | Easy to find on social media, and attackers try them first |
Keyboard patterns like qwerty | On every attacker's list |
Real words with @ for a | Automated tools try these swaps |
| The same password with a number changed | One leak reveals the pattern |
| Passwords you picked "at random" in your head | People are not random |
Step 5: Add a second lock
Even a perfect password can be stolen, usually by a fake login page. Two-factor login means a thief also needs a second proof, such as a code from an authenticator app. Add it to your email and bank first, because those accounts protect everything else.
If you hold crypto, one more secret needs separate handling. Read why a seed phrase is different from a password.