How to Make a Password You Can Actually Remember (and Still Trust)

October 17, 2026 • NOFYI Editorial Team

Most password advice is hard to follow because it asks you to remember something impossible. A random string of letters, numbers, and symbols may be strong, but if you cannot remember it, you will write it on a sticky note, reuse it, or reset it every time. None of those habits help.

A better approach is to make a password that is both long and memorable. The passphrase method does exactly that. It uses ordinary words you can picture, arranged in a way that is hard for someone else to guess. This guide explains how to build a passphrase, how to test the idea with examples, and how to combine it with a password manager and two-factor authentication.

Important: every password in this guide is an example only. Never use an example password from any article as a real password. The examples are here to show the method, not to be copied.

Why Short Passwords Fail

A short password fails for two reasons. First, it has fewer possibilities, so an attacker can try more combinations in less time. Second, short passwords are often based on familiar patterns: a name, a birth year, a favourite team, a keyboard pattern, or a common word with a number at the end. Those patterns are exactly what attackers try first.

Adding one exclamation mark or changing one letter to a number does not fix a short, predictable password. If the base pattern is common, small changes are also common. Length matters more than clever tricks. A longer password takes far longer to guess, especially when it is not built from a single predictable pattern.

That is why the passphrase method works. It makes length easy. Four or five ordinary words give you a long password without forcing you to memorise a random string.

What Is a Passphrase?

A passphrase is a password made from several words rather than one word or one random string. For example, a passphrase might be four words joined together, with spaces, hyphens, or another separator between them. The words should be random, not a sentence that makes sense.

Randomness is the key. Four words chosen by chance are much harder to guess than four words that form a famous quote, a song lyric, or a sentence about your life. If someone knows you love a particular band, a passphrase built from that band name is easier to guess than one built from unrelated words.

Think of it this way: each random word adds a large set of possibilities. Four random words together create a huge number of combinations. An attacker cannot simply try your name, your pet, and your birth year and expect to find it.

How to Make a Passphrase, Step by Step

Pick four random words. Choose words that are unrelated to each other and to you. You can use a word list, a dice-based word list, or a trusted password manager that can generate a passphrase. Do not pick words from your address, your family, your hobbies, or your favourite media.
Make a mental picture. Imagine the four words together in a strange scene. The stranger the picture, the easier it is to remember. You do not need to write the picture down. The picture is only a memory aid.
Join the words. Join them with a separator you will remember, such as a hyphen, an underscore, or a space if the site allows spaces. Use the same separator between each word so you do not have to remember where it goes.
Add a little variety if you want. You can capitalise one word, add a number, or add a symbol at the end. These additions are optional. Length and randomness matter more than a single symbol.
Check the length. Aim for a passphrase that is at least 16 to 20 characters long, including separators. Longer is better if you can still remember it. Four average words plus separators usually reach this range.
Make it unique. Use a different passphrase for each important account. Never reuse the same passphrase across accounts, even with a small change.

If a site does not allow spaces, use hyphens or underscores. If a site has a short maximum length, choose a different method for that site, such as a password manager generated password, and store it safely.

Worked Example: Building a Passphrase

Here is a worked example using invented words. This is not a real password. Do not use it. It is here only to show the method.

Start with four unrelated example words: correct, horse, battery, staple. These words are famous from a well-known example about passphrases, which is exactly why you should not use them as a real password. They are useful here because they show the structure clearly.

Now join them with hyphens: correct-horse-battery-staple. Count the length. The words have 7, 5, 7, and 6 letters, plus three hyphens, for a total of 28 characters. That is long, but it is made of only four words, so it is easier to picture and remember than a 28-character random string.

Next, imagine a strange scene: a correct answer written on a horse, next to a battery, next to a staple. The scene is odd, which helps memory. You do not need a perfect story. You need a picture that reminds you of the four words in order.

For a real passphrase, you would choose four different random words that are not from this example, not from a famous list, and not connected to your life. You would also use a different separator or capitalisation if you wished. The method stays the same; the words change.

Another way to think about it: if you used only one word, an attacker could try common words quickly. If you used two words, the combinations grow. With four random words, the combinations grow far beyond what a simple guessing attack can cover. That is why length plus randomness works.

Why Length Matters More Than Complexity

Many people focus on complexity: upper case, lower case, numbers, symbols. Complexity helps, but length helps more. A long passphrase made of ordinary words can be stronger than a short password full of symbols, and it is much easier to remember.

Consider a short password with eight characters, even with mixed symbols. It has a limited number of possibilities. A four-word passphrase with 25 to 30 characters has a far larger space of possibilities, even if the characters themselves are ordinary letters and hyphens.

This does not mean you should use a long but predictable sentence. A sentence from a book, a quote, or a phrase about your life is easier to guess than random words. The best combination is long plus random plus memorable to you, not predictable to someone else.

Use a Password Manager

Even a memorable passphrase is hard to manage if you have dozens of accounts. A password manager solves that problem. It stores each password in an encrypted vault, locked by one strong master passphrase that you remember.

With a password manager, you can give every account a unique password. You do not need to remember all of them, because the manager fills them in for you. You only need to remember the master passphrase, and you need to protect it carefully.

Choose a reputable password manager, set a strong master passphrase using the method above, and turn on two-factor authentication for the manager itself. Keep a secure backup of your recovery information in a safe place, such as a printed recovery code stored securely, not in an ordinary note on your phone.

A password manager also helps you spot reuse. If the manager warns that you have used the same password on several sites, change those passwords to unique ones, starting with email, banking, and other high-value accounts.

Add Two-Factor Authentication

Two-factor authentication, often called 2FA, adds a second check beyond the password. Even if someone learns your password, they still need the second factor to sign in.

The second factor can be a code from an authenticator app, a security key, or a code sent to a trusted device. An authenticator app or a security key is generally stronger than a code sent by text message, because text messages can be intercepted or redirected in some attacks. Use the strongest option the site offers.

Turn on 2FA for your most important accounts first: email, password manager, banking, cloud storage, and social accounts that can be used to reset other accounts. Email is especially important, because access to your email can often be used to reset many other passwords.

When you set up 2FA, save the backup or recovery codes in a safe place. If you lose your phone or authenticator app, those codes are how you regain access. Do not store them in the same place as your passwords unless your password manager is designed for that.

Never Reuse Passwords

Reusing a password is one of the most common and most dangerous habits. If one site has a data breach, attackers can try the same email and password on other sites. This is called credential stuffing. It works because many people reuse passwords.

Even a small change does not fix reuse. Changing one character, adding a number for each site, or using the same base password with a site name at the end still follows a pattern. If an attacker learns one version, they can guess the pattern for other sites.

The rule is simple: one account, one password. Use a password manager to make this practical. If you cannot use a manager for a particular account, make that passphrase unique and do not copy it anywhere else.

How to Change a Weak Password Safely

If you know a password is weak or reused, change it. Start with email, then banking, then your password manager, then other important accounts. Use a unique passphrase or a generated password for each one.

Change the password from the official site or app, not from a link in an unexpected email or message. After you change it, sign out of other devices if the site offers that option, and check that 2FA is still turned on.

Do not change a password by adding one character to the old one. Create a new, unique passphrase. If the site offers a password strength meter, use it as a rough guide, not as proof. A meter can be fooled by predictable patterns that still look complex.

What Not to Do

Do not use personal information: your name, birth date, pet, school, team, or address. Do not use keyboard patterns such as consecutive keys. Do not use common passwords from breach lists. Do not share passwords in chat, email, or notes. Do not write passwords on sticky notes or in unprotected files.

Do not use an example password from any article, including this one. Example passwords are public, and attackers may try them. Always create your own random passphrase.

Do not test a real password in a strength checker website that you do not trust. If you want to test the method, test with invented example words, not with a password you actually use.

Limitations

A passphrase is not perfect. If someone watches you type it, sees it on your screen, or installs malware on your device, even a strong passphrase can be stolen. That is why 2FA and device security matter. Keep your device updated, use a screen lock, and be careful on shared computers.

Some sites have short password limits or do not allow spaces or long passwords. In those cases, a passphrase may not fit. Use the longest unique password the site allows, and store it in a password manager.

A passphrase also does not protect you if you enter it on a phishing site. Always check that you are on the real site before you sign in. A password manager that only fills passwords on the correct site can help reduce this risk.

Frequently Asked Questions

How long should my password be?

Aim for at least 16 to 20 characters. Four random words plus separators usually reach this range. Longer is better if you can still remember it. Use a password manager for passwords you do not need to memorise.

Are four random words really enough?

Four random, unrelated words create a large number of combinations and are much stronger than a short predictable password. The words must be random and not connected to you. Do not use a famous example, a quote, or a sentence about your life.

Should I use a password manager or memorise passwords?

Use both. Memorise one strong master passphrase for your password manager, and let the manager store unique passwords for each account. Turn on two-factor authentication for the manager and for your most important accounts.

Can I test my password strength online?

Do not test a real password on a website you do not trust. Test the method with invented example words only, never with a real password. A strength meter is a rough guide, not proof, and it cannot detect whether a password has been exposed in a breach.

Conclusion

A password you can remember and trust is not a trick. It is a long, random, unique passphrase, stored safely, protected by two-factor authentication, and never reused. Choose four random words, picture them, join them, and make each account unique. That habit, repeated across your accounts, is more useful than any single clever symbol.