Try it now: use our free Password Generator to create a strong password in seconds.
Introduction
Last month I watched a friend reset the same email password for the third time in one sitting. She had made it “secure” the way we were all taught: a short word, a capital letter, a number swapped in for a letter, an exclamation mark at the end. Something like Sunshine@2024. It looked complicated. It was also forgettable, and not nearly as strong as it looked.
Attackers do not sit there typing guesses by hand. Their software tries millions of common words, names, dates, and predictable patterns in seconds, and Sunshine@2024 follows a pattern they know very well.
There is a better approach, and it is simpler: use a passphrase. Several ordinary words joined together, long enough that guessing them would take an absurd amount of time, but normal enough that you can hold them in your head.
Why length beats clever tricks
A short password has a limited number of possible combinations, even with symbols mixed in. Length changes the maths much faster. Every extra character multiplies the number of guesses needed.
That is why a passphrase like this works:
purple mango bicycle rain
Four common words. It is 25 characters long once you count the spaces, and it paints a silly picture — a purple mango riding a bicycle in the rain — which is exactly why it sticks.
How to build your own passphrase
Step 1: Pick words that are not connected to you
Avoid your name, your children’s names, your street, your football team, your birthday, and your pet. Those are the first things someone who knows you — or who can see your social media — would try.
Instead, think of unrelated everyday objects. Kitchen items, weather, colours, animals, places you have never visited. Random is good. Personal is not. A mix like kettle, forest, orange, ladder tells no story about your life, and that is the point.
Step 2: Put four or five words together
Four words is a sensible minimum for an important account like your main email. Five is better for something you rarely change. Join them with spaces if the site allows spaces. If it does not, use hyphens and add a number at the end to satisfy the site’s rules:
kettle-forest-orange-ladder7
Step 3: Picture it, then type it
Spend ten seconds making a strange mental image. A kettle in a forest, an orange balanced on a ladder. The sillier the picture, the better you will recall it a month later. We remember images far more easily than strings of characters, so use that.
Step 4: Give each important account its own
This is where most people undo all the good work. One strong password used everywhere is still one password. If a shopping site you used once in 2022 gets breached and that password leaks, attackers will try it on email, banking, and social media accounts automatically. It is called credential stuffing, and it works because reuse is so common.
You do not need fifty memorised passphrases. Protect the big ones individually:
- Your main email — this is the master key, because password resets go there
- Your bank and payment accounts
- Your main social media account
For the long list of smaller accounts, use a password manager: one app that stores a different, random password for each site, locked behind the one strong passphrase you built above. You memorise one thing properly, and the manager handles the rest.
Add the second layer
Even a great passphrase should not work alone. Turn on two-factor authentication wherever it is offered, especially on email and banking. After your password, the site asks for a code from an app on your phone or a prompt you approve.
It takes a few extra seconds, but a stolen password on its own is then no longer enough to get in. If you are offered a choice between a code by text message and an authenticator app, pick the app when you can. It is harder to intercept.
Mistakes that quietly weaken a good password
- Reusing one password across sites. Easily the most damaging habit, and the most common.
- Making small changes and calling it new. Changing
...2024to...2025does not fool software that tries those variations. - Using a famous quote or song lyric. Attackers have lists of these too. Random unrelated words beat a well-known phrase.
- Sharing it in a message. If you must help a family member, change the password afterwards.
- Storing everything in an unprotected notes file. A note titled “Passwords” on a lost phone is a gift to whoever finds it.
One honest note: a passphrase written on paper and kept safely at home is far less risky than reusing a weak password everywhere. Do not carry the paper with the device, and do not photograph it into an unprotected gallery.
Frequently Asked Questions
If I write my passphrase on paper, is that a stupid idea?
No, not if the paper stays at home somewhere sensible, like with your other important documents. It becomes a problem when it travels with your laptop, sits on a sticky note on the screen, or gets photographed and shared. For most people, a safely kept paper backup beats a weak password they reuse because they are scared of forgetting a strong one.
How often am I supposed to change these?
Far less often than old advice suggested. If a passphrase is long, unique to that account, and there is no sign of a breach, changing it every few months adds little. Change it straight away if a site says it has been breached, if you shared it, or if you logged in on a device you do not trust. Otherwise, leave a working system alone.
My password got rejected for having no symbol. Now what?
Keep your words and simply add the required character at the end, and capitalise the first letter if a capital is demanded too. The length from your words is doing most of the protective work, so a small adjustment for the form is fine. Note down exactly what you added, though — forgetting whether it was a ! or a # is a very common reason for lockouts.
Conclusion
Forget the short, tangled passwords that send you to the reset page again and again. Pick four or five unrelated words, picture them doing something ridiculous, use that passphrase to protect your password manager and your main email, and let every other account have its own. Add two-factor authentication on the important ones. That is a system a normal person can actually live with — and living with it is what makes it strong.
A quick example
Reading about passphrases is one thing; seeing one built is clearer. Here is the method from start to finish, using made-up words.
Step 1: Pick three or four unrelated words. Say: lantern, meadow and bicycle. They have nothing to do with each other, and nothing to do with the person using them — no pets, no birthdays, no favourite team. Unconnected words are harder to guess because there is no pattern to follow.
Step 2: Join them up. Put together, they make lanternmeadowbicycle — already 20 characters long. Length is doing the heavy lifting here: every extra character makes the password slower to crack by brute force, and three ordinary words are far easier to remember than eight random symbols.
Step 3: Add a number that means nothing. Slip a number in the middle rather than at the end, where guessing software looks first: lantern7meadowbicycle. Pick a number that is not a year, an age or anything from an address.
Step 4: Add one symbol. A single character changes the mix again: lantern7meadow!bicycle. The result is long, mixed, and still reads as a small story you can picture — a lantern, a number, a meadow, a bicycle.
| Password style | Why |
|---|---|
| Weak: Bicycle2020 | One real word plus a year is among the first combinations guessing software tries. Short, predictable, and tied to a guessable pattern. |
| Strong: lantern7meadow!bicycle | Several unrelated words give real length, and the number and symbol sit in the middle instead of the obvious end. Easy to picture, slow to crack. |
One warning before you use any of this: the password above is an example, printed here for everyone to read — never copy it, or any example, as your own. Build yours from your own unrelated words, and give each important account a different one.