Passwords That Are Strong and Easy to Remember

Most of us were taught to make passwords complicated: capital letters, numbers, symbols. The result is passwords like `P@ssw0rd1!` that are hard for people to remember but easy for computers to guess. Modern advice is simpler: make passwords long and unique.

How passwords get stolen

• Data breaches. A website you use is hacked and your password leaks. If you used it on other sites, attackers try it there. This is called credential stuffing.
• Guessing. Computers can try billions of guesses, starting with common words and patterns.
• Phishing. You are tricked into typing your password on a fake page.

The three random words method

The UK National Cyber Security Centre recommends joining three random words to create a password. For example `coffee-train-purple`. It is long enough to resist guessing and easy to picture and remember.

• Use words that are unrelated. Do not use song lyrics, quotes, or your family names.
• Add numbers or symbols if a site demands them, but length is what counts.

Let a password manager do the rest

You cannot remember a unique strong password for dozens of sites. A password manager is an app that stores them securely behind one master password. It creates random passwords, fills them in for you, and warns you about reused or leaked passwords.

Clean up your accounts in 5 steps

1. Choose a password manager

   Pick a reputable one. Many phones and browsers have a built-in manager that works well for starting.

2. Create a strong master password

   Use a long three-word phrase and never reuse it anywhere. Write it on paper and keep it safe at home until you remember it.

3. Fix the important accounts first

   Email, banking, shopping, and social media. Your email is the most important, since it can reset all other passwords.

4. Replace reused passwords

   Let the manager generate a new random password for each account.

5. Turn on two-step verification

   Add a second check, such as an authenticator app, for your key accounts.

What most people miss

• Changing passwords regularly is no longer advised by many security bodies unless you suspect a breach. Forced frequent changes lead people to choose weaker patterns.
• Never share one-time passwords (OTP) with anyone, including callers claiming to be from your bank.
• Check if your email appeared in a breach. The free service Have I Been Pwned lets you check.

Sources

• NCSC: Use three random words
• NCSC: Password managers
• Have I Been Pwned