Creating a memorable password should not mean choosing a predictable one. A password manager can generate a different random password for every account. For a password you must remember, such as the manager’s master password, use a long, unpredictable passphrase.
Use a long passphrase
Choose several unrelated words at random and keep the full phrase. Avoid famous quotations, song lyrics, personal mottos and predictable substitutions. Taking the initials of a quotation can reduce it to a short password that is easy to guess. Do not reuse any password example published in an article.
Length helps, but it does not make an account immune to phishing, malware or a data breach. As a useful benchmark, NIST’s digital identity guidance requires at least 15 characters when a password is the sole authentication factor; its requirements for service providers differ when a password is part of multifactor authentication. This is guidance for those systems, rather than a universal rule imposed on every website.
Use a password manager
Let a reputable password manager generate and store unique passwords. Protect its master password, enable multifactor authentication where available, keep the software updated and store recovery information securely. KeePass is one option; obtain it from its official website and check which version and applications you are using.
Avoid personal and predictable information
Your name, birthday, company, pet’s name and favourite team are poor building blocks. Adding a year or an exclamation mark does not reliably fix a predictable password. When a service rejects a password known to have been compromised, choose a different one rather than making a small variation.
Use a different password for each account
Reusing a password allows a leak at one service to put other accounts at risk. Give email, banking and your password manager particular care. Replace a compromised password wherever it was reused and review account sessions and recovery settings.
Add another layer of protection
Enable multifactor authentication and consider passkeys or security keys where supported. They can reduce risks that a password alone cannot address. Keep devices updated and use a trusted bookmark or the service’s official app when signing in.
Reference: NIST SP 800-63B-4 — authentication and password guidance. Technical review: 30 October 2026.
