What makes a password strong?

A strong password is usually:

• Long (length matters more than "weird characters").
• Unique for every account (this prevents credential stuffing).
• Unpredictable (not based on names, dates, or common patterns).

A simple method you can actually remember

Use a passphrase (multiple words) plus a small site-specific twist. You get strength and uniqueness without memorizing a totally new password every time.

1) Start with a 4-6 word passphrase

Pick something vivid you can picture. Avoid famous quotes.

river paper lanterns fly at dawn

2) Add one personal rule

Example rule: capitalize the second word + use one separator you always remember.

river-Paper-lanterns@fly@at@dawn

3) Make it unique per site

Add a tiny "site code" in a consistent place. For example: first and last letter of the site name. (Any consistent rule works - keep it simple.)

river-PaperAm-lanterns@fly@at@dawn

The goal isn't to copy these examples. It's to use the formula: long passphrase + one rule + site code.

Quick examples: good vs. risky

Risky (avoid)

• Summer2026! (predictable)
• John1989! (personal info)
• qwerty12345 (common pattern)
• P@ssw0rd! (classic substitution)

Better

• Mint@River@Lantern@Dawn42 (long + memorable)
• copper-hills-quiet-stars-north (passphrase style)
• Window!Cactus!Orbit7 (pronounceable chunks)

How to remember strong passwords safely

Use a password manager (recommended)

It lets you use a unique, strong password everywhere - while you only remember one strong master passphrase. Turn on 2FA for your password manager and your email account.

If you don't use a manager yet

Memorize only your most important passwords (email, banking, and your main accounts). For everything else, use your passphrase + site-code method so you're not reusing the same password.

Common mistakes to watch for

• Reusing one "strong" password across sites.
• Making tiny variations: Password1 -> Password’ব? no
• Making tiny variations: Password1 -> Password2.
• Using personal data (birthdays, pets, teams, addresses).
• Skipping 2FA on email (email is the reset key for everything).

Mini checklist

• OK: Aim for 14+ characters or 4+ words
• OK: Make it unique per site
• OK: Avoid predictable patterns and personal info
• OK: Enable 2FA for email + important accounts

FAQ

Is length really more important than complexity?

In practice, yes. A longer password or passphrase is typically harder to crack than a short one with symbols. Ideally, you want both: long and not predictable.

Is it okay to write passwords down?

Writing passwords in plain text (notes, docs, screenshots) is risky. If you need help remembering, a password manager is usually the safest "write it down" option.