How to Create Strong Passwords (And Actually Remember Them)

Over 80% of data breaches involve weak or reused passwords. It's one of those things that everyone knows they should fix but rarely does. Here's a practical guide that actually works in the real world.

What makes a password weak?

The most commonly used passwords in 2024 were: 123456, password, qwerty, 111111, and abc123. Even passwords that seem complex — like P@ssw0rd — are in every hacker's dictionary list and will be cracked in seconds. Length and randomness are what matters.

The modern approach to strong passwords

Use a passphrase

Instead of a short complex password, use a long phrase. correct-horse-battery-staple is far harder to crack than C0rrect! because it's much longer. Four random words with hyphens makes an excellent password that's also memorable.

Use a password manager

This is the best solution for most people. A password manager (Bitwarden is free, 1Password and LastPass are paid) generates and stores unique, complex passwords for every site. You only need to remember one master password. The manager autofills everything else. This is what security professionals use.

Never reuse passwords

If you use the same password on multiple sites and one of those sites is breached, criminals will try that email/password combination on every major website and banking platform. This is called a credential stuffing attack.

Two-factor authentication (2FA)

Enable 2FA on every important account — your email, bank, social media, and cloud storage. This means even if someone has your password, they still can't log in without access to your phone. Use an authenticator app (Google Authenticator, Authy) rather than SMS where possible.