The strongest password in the world is useless if you reset it every week, and the password you actually use is usually the one you can remember. That tension has a practical answer: use a passphrase for the accounts you type often, and a random generated password for everything else.
What a passphrase is
A passphrase is four or five random words strung together, like a tiny sentence that means nothing to anyone but you. It is long, and length is what makes a password hard to guess by brute force, but it is made of words, so it is far easier to remember than the same length of random letters and symbols.
When to use which
- A passphrase: accounts you type often, like your email and your laptop login, where typing a long password every day has to be bearable.
- A random generated password: accounts you rarely type and keep in a password manager, where memorability does not matter at all.
- Neither, ever reused: the same password across important accounts means one leak opens all of them.
Build a good passphrase
- Pick four or more words at random, not a line from a song, a quote, or a famous phrase.
- Put a number or a symbol somewhere in the middle, not just at the end where everyone puts it.
- Make it long. A long passphrase of ordinary words beats a short password full of exotic symbols.
The rule that matters most is one password per important account. A password manager remembers the random ones, so you only have to memorise a few passphrases: your email, your devices, and the manager itself.
You can generate random passwords, and test passphrase ideas, with the Password Generator, all in your browser. Pick the method that fits how often you type it, and never reuse the result across accounts that matter.