How to Write a Strong Password You Can Actually Remember

The advice to "use a complicated password" gets the science half-right. What actually determines how hard a password is to crack isn’t cleverness — it’s entropy, which mostly comes down to length and randomness.

A short password with symbols, like "P@ss1!", has surprisingly little entropy — attackers know people substitute @ for a and 1 for i, so those patterns are baked into cracking tools. A longer, fully random string is dramatically harder to guess even without any symbols at all.

This is why current guidance from security researchers has shifted toward length over complexity. A random 16-character password, or a four-to-six-word random passphrase (like "correct horse battery staple," to borrow the famous XKCD example), beats a short "complex-looking" password almost every time.

The catch with true randomness is memorability. The practical fix most security professionals recommend is: use a password manager to generate and store long random passwords for everything except a small handful of accounts, and for the few you truly need to memorize (like your password manager’s master password), use a random passphrase of unrelated words rather than a single complex word.

Reusing passwords across sites is a bigger risk than most people realize — a breach at one unrelated company can expose your login everywhere else you reused that password. A password manager solves this by making a unique password per site painless.

Our Password Generator creates cryptographically random passwords in your browser (nothing is sent to a server) — set the length and character rules and generate as many as you need.