Strong Passwords: How to Create One You'll Still Remember Tomorrow

The password to your main email is the most underrated password in your life. Every other account gets recovered through email, so one leaked "email password" takes down your bank, your government portals, and your social media all at once. Let's figure out what actually makes a password strong — and how to remember it.

What no longer works

If your password is "Maria1985" or "P@ssw0rd", I have unpleasant news: variants like these have been in crackers' dictionaries for ages. Letter-to-lookalike swaps, birth years, the cat's name, keyboard walks like qwerty123 — all of it falls to an instant brute force, because cracking tools know these patterns.

Length beats cleverness

A password's strength is determined not by how tricky its characters are but by how many combinations an attacker has to try. Every added character multiplies that number; every clever substitution merely adds to it. That's why a long, "boring" password beats a short, intricate one:

• 6 digits (like a card PIN) — about 20 bits, cracked instantly;
• 8 characters from the full set — roughly 52 bits, cracked in hours on clusters;
• 12 characters from the full set — about 79 bits; a brute-force attack would take millions of years.

The practical takeaway: go for at least 12–16 characters. You can generate a random combination with the password generator — it uses the system's random number generator, shows a strength estimate, and never sends the result to a server.

How to remember it

The honest answer: memorizing 50 random passwords is neither necessary nor possible. The only thing you need to memorize is the password to your password manager. For that master password (email + the manager itself), the "a phrase only you know" scheme works: take a meaningful 4–5 word sentence, add a digit and one symbol in an unexpected spot. For example, the opening of a favorite song lyric you've never posted anywhere, plus the name of the first city you visited on a trip.

The safety net: two-factor authentication

Even a perfect password can leak through a phishing site. So turn on two-factor authentication for your email and your password manager: an app-generated code instead of SMS, with backup codes kept somewhere safely offline. This is the case where ten minutes of setup pays for itself many times over.