How to Choose a Strong, Memorable Passphrase
Length, unpredictability, and uniqueness matter more than decorative substitutions. A password manager is usually the best home for random credentials; a passphrase is useful when you must remember and type one.
Start with the threat you can control
A password must resist guessing and must not unlock multiple accounts. Reusing one excellent password across services turns a breach at one service into a key for the others. Make every account unique, and enable multi-factor authentication where it is available.
For credentials you do not need to memorize, let a reputable password manager generate and store a long random value. Reserve a memorable passphrase for a password-manager master password or another place where manual entry is unavoidable.
Build a passphrase without a personal story
Choose several words randomly from a sufficiently large list. Do not use a quotation, lyric, address, birthday, pet name, or sentence someone could associate with you. Random selection matters because attackers test common phrases and predictable substitutions before trying arbitrary combinations.
- Use more words when the service permits long passwords.
- Keep the word selection random rather than choosing a sensible sentence.
- Do not reuse the result on another account.
- Store a recovery method separately and securely.
Why composition tricks disappoint
Turning Password into Password1! follows a pattern attackers already expect. Modern guidance emphasizes adequate length, blocking commonly used or compromised passwords, permitting password managers and paste, and avoiding arbitrary periodic changes unless compromise is suspected. A symbol can be part of a strong password, but it does not rescue a short or predictable one.
Check the result safely
Confirm that the target service accepts the full length and spaces or separators you intend to use. Save the credential before signing out, then verify the login and recovery method. Never paste a real password into a random strength-checking website; generate and evaluate structure without disclosing an existing secret.
Primary sources and further reading
Last reviewed: September 15, 2026