How to Create Strong Passwords You Can Actually Remember

How passwords really get cracked

Attackers rarely sit and type guesses. They use software that tries millions or billions of combinations per second against stolen password databases, starting with the most likely ones:

• Common passwords such as 123456, password and qwerty.
• Dictionary words with predictable tweaks, like Summer2026! or P@ssw0rd.
• Personal details found on social media: names of children, pets, teams and birthdays.
• Credential stuffing: trying email and password pairs leaked from one website on hundreds of others.

A strong password is simply one that is not on any of those lists and would take an impractically long time to guess.

Length beats complexity

Every extra character multiplies the number of possible combinations. A random 8-character password using letters, numbers and symbols has around 6 quadrillion combinations, which modern hardware can work through quickly when a database is stolen. A random 16-character password has so many combinations that guessing it is not realistic with today’s technology.

That is why current guidance from security bodies such as the US National Institute of Standards and Technology (NIST) focuses on length and uniqueness rather than forcing a symbol and a capital letter into short passwords.

Never use the example passwords above; they are now public.

Use passphrases for passwords you must remember

You only need to memorise a handful of passwords: your computer or phone login, your email account and your password manager. For these, a passphrase of five or more truly random words is both strong and easy to type.

1. Pick words at random, for example by opening a book on random pages or rolling dice with a word list. Do not choose a song lyric or famous quote.
2. Join them with hyphens or spaces: lantern-orbit-velvet-cactus-meadow.
3. If a website demands a number or symbol, add one in the middle rather than at the end.
4. Picture a silly scene connecting the words to remember it.

Let a password manager remember the rest

Nobody can remember a different strong password for 100 accounts, and reusing passwords is the biggest risk of all. A password manager stores every password in an encrypted vault, fills them in for you and can generate new ones. Reputable options include Bitwarden, 1Password, Proton Pass and the managers built into Apple, Google and Microsoft accounts.

With a manager in place, every website can get a unique random password of 16 to 20 characters that you never need to see.

Generate random passwords with Tolket

1. Open the free Password Generator.
2. Choose a length of at least 16 characters and the character types the website allows.
3. Check the strength meter, which shows the entropy in bits and an estimated cracking time.
4. Copy the password straight into your password manager or the sign-up form.

Passwords are created on your device using your browser’s cryptographically secure random number generator. Nothing is stored or sent anywhere.

Turn on two-factor authentication

Even a perfect password can be stolen by a fake login page. Two-factor authentication (2FA) adds a second step, such as a code from an authenticator app, a passkey or a hardware security key, so a stolen password alone is not enough. Turn it on first for your email, banking and social media accounts. Authenticator apps and passkeys are safer than SMS codes, which can be intercepted through SIM-swap fraud.

Good password habits

• Use a unique password for every account, especially your email.
• Never share passwords by text message or chat; password managers offer secure sharing.
• Check whether your email appears in known breaches at Have I Been Pwned and change any affected passwords.
• Change a password immediately if a service reports a breach, but there is no need to rotate strong, unique passwords every month.
• Be suspicious of login links in emails; type the website address yourself.

Frequently asked questions