How to Create a Strong Password You Can Remember

What makes a password strong

Attackers don't guess passwords one at a time by hand. When a website is breached, they get a file of scrambled (hashed) passwords and test billions of guesses a second against it, offline. A password's strength is simply how many guesses it would take.

Three things decide that number:

1. Length — how many characters or words.
2. The pool — how many choices there are for each position (26 lowercase letters, 90 mixed characters, or 1,247 words).
3. Randomness — whether each choice was truly random, or picked by a human with habits an attacker can predict.

The third point is the one people miss. Delhi@2026 has letters, a capital, a symbol and digits, but it follows a pattern that cracking tools try early: a word, a symbol, a year. Real randomness only comes from a machine or from dice.

Entropy in plain words (with real numbers)

Security people measure strength in bits of entropy. Each extra bit doubles the number of guesses needed. Forty bits means about a trillion possibilities; eighty bits means a trillion times more than that.

The maths is short. Each character adds log₂ of the pool size:

• Lowercase only: log₂(26) ≈ 4.70 bits per character.
• All four types (26 + 26 + 10 + 28 symbols = 90): log₂(90) ≈ 6.49 bits per character.
• One word from our 1,247-word list: log₂(1,247) ≈ 10.28 bits per word.

Our password generator shows this number live, plus an average crack time. It assumes a fast attack: 10 billion guesses a second against a fast, unsalted hash, with the attacker knowing exactly how the password was made. Here are figures from its own calculator:

Why 103.6 bits and not 16 × 6.49 = 103.9? The generator's "use every type" rule removes the few passwords that would miss a type. Sites that store passwords with slow hashes such as bcrypt make every row in this table thousands of times harder.

Note: These numbers only hold for random passwords. A password you invented yourself has far less entropy than its length suggests, because people choose predictable words and patterns.

Length beats complexity

Look at the table again. Switching an 8-character password from lowercase to all four character types adds about 13 bits. Making it 16 lowercase letters instead adds 37.6 bits. Doubling the length wins by a wide margin.

That's why current US government guidance has moved away from complexity rules. NIST SP 800-63B, revised in 2025, tells services to:

• require at least 15 characters for a password used on its own (8 if it's one part of multi-factor login);
• allow passwords of at least 64 characters;
• not impose composition rules such as "one uppercase, one digit, one symbol";
• not force periodic password changes, only a change when there's evidence of compromise;
• check new passwords against a blocklist of common and breached passwords;
• allow password managers, autofill and paste.

Many websites still demand a symbol or a digit. That's fine: a long random password from the generator can include them without losing anything.

How to build a passphrase you can remember

You can't remember 100 random passwords, and you shouldn't try. But you do need to remember a few: your device login, your email and your password manager's master password. For those, use a passphrase.

A passphrase is several random words joined together, like Nail-Slate-Tweak-Buzz-Herbs1-Speak. Here's how to make a good one:

1. Let a machine (or dice) pick the words. Open the password generator and switch to Passphrase. Words chosen in your head ("sunny beach holiday") are far easier to guess.
2. Use at least 6 words. That gives about 62 bits. For a password manager's master password, 7 words (about 72 bits) is a sensible step up.
3. Add a separator. Hyphens, spaces, full stops or underscores all work. The separator doesn't add much strength; it makes the phrase readable.
4. Turn on "Add a number" if a site demands a digit. It puts one digit on a random word and adds about 6 bits.
5. Make a silly picture in your head. For the example above: a nail scratching slate, a tweak, a buzz, herbs, someone speaking. Odd images stick.
6. Type it a few times today and tomorrow. Repetition in the first 48 hours does most of the work.

The generator's word list has 1,247 short, common English words of 3 to 5 letters. It is based on the EFF Short Wordlist by the Electronic Frontier Foundation (CC BY 3.0 US), with a few names, brands and unpleasant words removed. EFF designed that list for memorable passphrases, and you can also use it with ordinary dice if you'd rather not trust any website.

Tip: Don't edit the generated phrase to make it "more personal". Swapping a random word for your pet's name throws away entropy and adds something an attacker could find on your social media.

Password managers: the real answer for everything else

For every other account, don't remember anything. Let a password manager create and store a unique random password of 16 or more characters.

• Built-in options: Google Password Manager, Apple Passwords (iCloud Keychain), Microsoft Edge's manager and Firefox's manager are all free and sync across your devices.
• Dedicated managers: these add secure sharing with family, breach alerts and support for every browser and phone.

Either type is a big improvement over reusing one password. Protect the manager itself with a strong passphrase and two-factor authentication.

Not everything that looks like a password is one. If you need a random, unique identifier for a test account, a database record or a file name, use the UUID generator instead. Version 4 UUIDs carry 122 random bits, but they're meant as IDs, not as secrets you type.

Two-factor authentication and other habits

A strong password protects you from guessing. It doesn't protect you if you type it into a fake login page. That's where these habits come in.

• Turn on two-factor authentication (2FA) for email, banking, UPI apps, social media and your password manager. An authenticator app, a security key or a passkey is stronger than an SMS code, but SMS is far better than nothing.
• Never reuse a password. When one site is breached, attackers try the same email and password on hundreds of others. This is called credential stuffing, and unique passwords stop it completely.
• Use passkeys where offered. A passkey replaces the password with a key stored on your phone or laptop. It can't be phished or reused.
• Check before you type. Look at the address bar. Your bank's login page will never arrive through a WhatsApp link.
• Act on breach alerts. If a service tells you it was breached, change that password and any account where you used something similar.

What not to do

These are the patterns cracking tools try first:

• Personal details: names, birthdays, phone numbers, vehicle numbers, cricket teams, pin codes.
• Keyboard walks: qwerty, 1qaz2wsx, asdfgh.
• Common words with swaps: P@ssw0rd, Adm1n!. Tools test these substitutions automatically.
• A base password plus a site name: Rohan@2026Amazon, Rohan@2026Flipkart. One leak reveals the pattern.
• Short "complex" passwords: 8 characters of anything can fall in about a day to a fast offline attack.
• Writing passwords in a notes app or a shared spreadsheet. A paper note at home is safer than an unencrypted file on a cloud drive.
• Sending passwords over chat or email. If you must share one, use your password manager's sharing feature.

Pick one account today — usually your email, because it can reset all the others — and give it a fresh 6-word passphrase and 2FA. Then move the rest into a password manager over the next week.