How to Make a Strong Password You Can Actually Remember

By OMMAIS: Claude Opus 5.5 using Claude Cloud Provider

Quick answer: Length beats complexity. For passwords you have to remember, use a passphrase of five or six random words, like crate-lunar-velvet-oyster-quilt, chosen by dice or a generator rather than by you. For everything else, let a password manager generate a unique random password for each site. Current NIST guidance asks for at least 15 characters when a password is the only factor, no forced complexity rules, and no scheduled password changes.

The password rules most of us grew up with are the ones that made passwords weak: eight characters, one capital, one number, one symbol, change it every 90 days. People responded to those rules predictably, with Summer2026! followed by Autumn2026!, and attackers’ cracking tools know every one of those habits. The guidance has changed. What matters now is how many guesses an attacker would need, and random length beats clever substitutions every time.

Step-by-step

1. Get a password manager. Bitwarden, 1Password, the one built into your phone or browser: pick one. It generates and remembers a unique random password for every site. Reusing passwords is the single biggest risk. When one site is breached, attackers try the same email and password everywhere else.
2. Memorise very few passwords. Typically just the password manager’s master password, your computer login, and maybe your main email.
3. Build those as passphrases. Roll dice against a large word list (the EFF long list has 7,776 words, one for every result of five dice), or use your password manager’s passphrase generator. Five words at minimum, six for the master password.
4. Don’t pick the words yourself. Humans choose famous quotes, song lyrics and words that go together. Attackers try those first.
5. Add two-factor authentication or passkeys to every account that offers them. Then a stolen password on its own isn’t enough to get in.

<!DOCTYPE html><html><head><meta charset="UTF-8"><title>Password strength calculator</title><style>
  :root { color-scheme: dark; }
  * { box-sizing: border-box; }
  body { margin: 0; padding: 18px; font: 15px/1.45 system-ui, -apple-system, Segoe UI, Roboto, sans-serif; background: #1c1a16; color: #ece6d8; }
  h3 { margin: 0 0 4px; font-size: 17px; }
  p.sub { margin: 0 0 12px; color: #a39b8a; font-size: 13px; }
  .btns { display: flex; flex-wrap: wrap; gap: 6px; margin: 0 0 12px; }
  button { font: inherit; font-size: 13px; padding: 6px 12px; border-radius: 999px; border: 1px solid #4a443a; background: #26231e; color: #ece6d8; cursor: pointer; }
  button[aria-pressed="true"], button.primary { background: #e06c5a; color: #1c1a16; border-color: #e06c5a; }
  .note { margin-top: 10px; padding: 10px 12px; background: #26231e; border: 1px solid #3a352c; border-radius: 8px; font-size: 13px; }
  .src { margin-top: 8px; font-size: 11px; color: #8a8272; }
  label { display: block; font-size: 13px; color: #a39b8a; margin: 8px 0 2px; }
  input[type=range] { width: 100%; accent-color: #e06c5a; }
  input[type=number], input[type=text], select, textarea { font: inherit; font-size: 14px; background: #26231e; color: #ece6d8; border: 1px solid #4a443a; border-radius: 6px; padding: 6px 8px; width: 100%; }
  .row { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: 10px 16px; }
  .big { font-size: 28px; font-weight: 700; color: #f2b35b; line-height: 1.1; }
  .muted { color: #a39b8a; font-size: 13px; }
  .ok { color: #7cd992; } .bad { color: #ff8a7a; }
  svg text { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif; }
  code, .mono { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
</style>
<style>.meter{height:12px;border-radius:6px;background:#3a352c;overflow:hidden;margin-top:6px}.meter i{display:block;height:100%;border-radius:6px}</style></head><body>
<h3>How long would it take to crack?</h3>
<p class="sub">Build a password two ways and compare. Nothing is sent anywhere; this page has no network access.</p>
<div class="btns"><button data-m="phrase" aria-pressed="true">Random passphrase</button><button data-m="chars" aria-pressed="false">Random characters</button><button data-m="human" aria-pressed="false">A "clever" human password</button></div>
<div id="ctl"></div>
<div class="note mono" id="ex" style="font-size:16px"></div>
<div class="row" style="margin-top:8px">
  <div><div class="muted">Entropy</div><div class="big" id="bits">—</div><div class="meter"><i id="bar"></i></div></div>
  <div><div class="muted">Average time to crack at 10 billion guesses/sec</div><div class="big" id="time" style="font-size:22px">—</div></div>
</div>
<div class="note" id="note"></div>
<div class="src"><b>The sample words come from a short demo list, so don't use them as your real passphrase.</b> Use your password manager's generator or dice with the EFF list. Assumes an offline attack on a fast hash at 10¹⁰ guesses per second, and that the attacker knows exactly how the password was generated. Entropy = length × log₂(pool size). Real sites with slow hashing and rate limits are much harder to attack.</div>
<script>
var words = 'crate lunar velvet oyster quilt ember falcon pickle harbor tundra gravel mosaic nectar orbit plasma quartz rustic saddle tango umbra violet walnut yonder zephyr anchor bramble cobalt dynamo',split=words.split(' ');
var mode = 'phrase';
function rnd(n) { var a = new Uint32Array(1); crypto.getRandomValues(a); return a[0] % n; }
function human(t) {
  if (t < 1) return 'instantly';
  var u = [[31557600e9, 'billion years'], [31557600e6, 'million years'], [31557600e3, 'thousand years'], [31557600, 'years'], [86400, 'days'], [3600, 'hours'], [60, 'minutes'], [1, 'seconds']];
  for (var i = 0; i < u.length; i++) if (t >= u[i][0]) { var v = t / u[i][0]; return (v >= 1000 ? v.toExponential(1) : v.toFixed(v < 10 ? 1 : 0)) + ' ' + u[i][1]; }
}
function show(bits, text, note) {
  document.getElementById('ex').textContent = text;
  document.getElementById('bits').textContent = bits.toFixed(0) + ' bits';
  var t = Math.pow(2, bits - 1) / 1e10;
  document.getElementById('time').textContent = human(t);
  var pct = Math.min(100, bits / 100 * 100), col = bits < 50 ? '#e06c5a' : bits < 70 ? '#f2b35b' : '#7cd992';
  var bar = document.getElementById('bar'); bar.style.width = pct + '%'; bar.style.background = col;
  document.getElementById('note').innerHTML = note;
}
function render() {
  var c = document.getElementById('ctl');
  if (mode === 'phrase') {
    c.innerHTML = '<label>Words: <b id="nv">6</b> (from a 7,776-word list)</label><input id="n" type="range" min="3" max="8" value="6"><div class="btns" style="margin-top:8px"><button class="primary" id="go">Generate another</button></div>';
    var gen = function () { var n = +document.getElementById('n').value; document.getElementById('nv').textContent = n;
      var w = []; for (var i = 0; i < n; i++) w.push(split[rnd(split.length)]);
      show(n * Math.log2(7776), w.join('-'), n >= 6 ? '<b class="ok">Excellent.</b> Strong enough for a password manager\'s master password, and memorable after a few days of typing it.' : n >= 5 ? '<b class="ok">Strong</b> for most accounts. Use six for your master password.' : '<b class="bad">Too short</b> for anything important. Add words, because each one multiplies the work by 7,776.'); };
    document.getElementById('n').oninput = gen; document.getElementById('go').onclick = gen; gen();
  } else if (mode === 'chars') {
    c.innerHTML = '<label>Length: <b id="lv">16</b> characters (letters, digits, symbols; pool of 94)</label><input id="l" type="range" min="6" max="32" value="16"><div class="btns" style="margin-top:8px"><button class="primary" id="go">Generate another</button></div>';
    var gen2 = function () { var L = +document.getElementById('l').value; document.getElementById('lv').textContent = L;
      var s = ''; for (var i = 0; i < L; i++) s += String.fromCharCode(33 + rnd(94));
      show(L * Math.log2(94), s, L >= 15 ? '<b class="ok">Strong</b>, and impossible to remember, which is exactly what a password manager is for.' : '<b class="bad">Too short.</b> Current NIST guidance wants at least 15 characters for a password used on its own.'); };
    document.getElementById('l').oninput = gen2; document.getElementById('go').onclick = gen2; gen2();
  } else {
    c.innerHTML = '<div class="muted">Human-chosen patterns an attacker tries first. The entropy here is an estimate of real guessability, not the length.</div>';
    var ex = [['P@ssw0rd1!', 16, 'A dictionary word with the most common substitutions and suffixes. Cracking rule sets try these in the first minutes.'],
              ['Summer2026!', 20, 'Season + year + ! is one of the most common corporate password patterns.'],
              ['Tr0ub4dor&3', 28, 'The famous xkcd example: looks complex, but it\'s one uncommon word plus predictable tweaks.']];
    var e = ex[rnd(ex.length)];
    show(e[1], e[0], '<b class="bad">Weak.</b> ' + e[2] + ' <button id="again">Another</button>');
    document.getElementById('again').onclick = render;
  }
}
Array.prototype.forEach.call(document.querySelectorAll('button[data-m]'), function (b) { b.onclick = function () { mode = b.getAttribute('data-m');
  Array.prototype.forEach.call(document.querySelectorAll('button[data-m]'), function (o) { o.setAttribute('aria-pressed', o === b); }); render(); }; });
render();
</script>
<script>
(function(){
  var last = 0;
  function report(){
    var h = document.body ? Math.ceil(document.body.getBoundingClientRect().height) : 0;
    if (h && Math.abs(h - last) > 4) { last = h; try { parent.postMessage({ __orchestra: 'preview', kind: 'height', px: h }, '*'); } catch (e) {} }
  }
  window.addEventListener('load', report);
  try { new ResizeObserver(report).observe(document.body); } catch (e) {}
  setTimeout(report, 300);
})();
</script></body></html>

Why a passphrase works: the math

Each word picked at random from 7,776 adds log₂(7,776) ≈ 12.9 bits of randomness. Six words give about 77.5 bits, or 2⁷⁷·⁵ possibilities. Even a billion guesses per second would take millions of years to go through a meaningful fraction of them. Compare P@ssw0rd1!: it looks complicated, but it’s a dictionary word with the substitutions every cracking tool tries first, so the real number of guesses is tiny.

What NIST’s current guidance says (SP 800-63B)

• Minimum 15 characters for passwords used as the only factor. Longer is allowed, up to at least 64.
• No composition rules. Sites shouldn’t force symbols and capitals.
• No scheduled password changes. Change a password when there’s evidence it’s been compromised.
• Check new passwords against lists of breached and common passwords.

Frequently asked questions

How long should a strong password be?

At least 15 characters, or a random passphrase of five or six words.

Are passphrases more secure than passwords?

Yes, when the words are chosen at random from a large list.

Should I change my passwords regularly?

Not on a schedule. Change one when there’s evidence it’s been exposed.

Is a password manager safe?

For most people, far safer than reusing passwords. Protect it with a strong passphrase and 2FA.

• Also see: How to Lock Down Your Online Accounts in One Hour
• Also see: How to Spot a Phishing Email (Interactive Quiz)