How To Choose A Strong Password That You Can Actually Remember
Length beats complexity. Everything you were taught about symbols was a detour.
In short: a strong password is long rather than complicated, and unique rather than clever. Four unrelated words beats eight characters of punctuation, and a strong password reused anywhere else is not a strong password.
Most people were taught to build a strong password out of symbols and numbers, then change it every ninety days. That advice created passwords that were hard to remember, easy for computers to guess, and written on sticky notes.
The current guidance is simpler and it produces better passwords.
Length Beats Complexity
Four unrelated words make a strong password. Something like copper-harbor-piano-rust is longer, easier to remember and far harder to crack than P@ssw0rd!23.
Aim for at least sixteen characters. Beyond that, every extra character multiplies the time an attacker needs, which is why length wins so decisively.
Do not use a phrase from a song, a film or a book. Attackers have those. Unrelated words that only mean something to you are the point.
Never Reuse One, Ever
Reuse is the actual danger, not weakness. When a website you signed up for in 2015 is breached, attackers try that email and password everywhere else, automatically.
That is why a strong password used in two places is worse than two mediocre passwords used once each.
The only realistic way to keep them all different is a password manager, which is the next guide in this section.
Stop Changing Them On A Schedule
Forced ninety-day changes make passwords worse. People increment a number and the pattern is obvious to anybody who has seen one of them.
Change a password when there is a reason: a breach, a suspicion, somebody leaving who knew it. Not because a calendar said so.
The one thing worth doing on a schedule is checking whether any of your addresses appear in a known breach. Ask us and we will check for you.
A Quick Test For The Password You Use Most
Think of the password you type most often at work and ask three questions. Is it shorter than your phone number with the area code? Does it include a year, a sports team or a word from your job title? Have you used it on any other site?
A yes to any of them means it falls short of a strong password, however clever it felt at the time. Change that one before any other, because the login you use daily is the one an attacker would most want.
Habits That Quietly Undo A Strong Password
Typing it where others can see is the first mistake. A busy reception desk, or a screen shared on a video call, can give away a strong password in a few seconds. Stop sharing or turn the screen away before you sign in.
Answering security questions truthfully is the second. Your first school or your mother’s maiden name can often be found online, which makes the reset question the easy way in. Treat those answers as extra passwords and keep them in your password manager.
Letting a colleague sign in as you is the third. Once two people use one login, nobody can tell from the records who did what.
Saving it in the browser on a shared computer is the fourth. On a front desk or meeting room PC, choose Never when the browser offers to remember it, so a strong password does not wait there for the next person.
Password Warning Signs That Need A Call
An approval request on your phone when you are not signing in means someone may already have your password. Do not approve it, and call the security line at 678-374-4352, option 1, which is answered 24/7. Treat an alert about a sign-in from a place you have never been the same way.
Call the help desk at the same number if a system keeps rejecting each strong password you try, or locks you out straight after a change. The desk is open Monday to Friday, 8 AM to 5 PM Eastern, and a non-urgent ticket logged out of hours is picked up when it opens.
Why Length Beats Symbols
The advice most people learned was to make a password complicated. One capital, one number, one symbol. That advice produced millions of passwords like Password1! which are complicated to type and trivial to guess, because everyone made the same substitutions.
Modern guidance, including from the US standards body, favors length. A strong password is long and unusual rather than short and decorated. Four unrelated words is dramatically harder to crack than eight characters of punctuation soup, and far easier to type on a phone.
The reason is arithmetic. Every extra character multiplies the search space, while a predictable substitution adds almost nothing because the guessing tools already know that people replace a with @.
So if you take one thing from this: make it longer, not weirder.
Uniqueness Is The Part That Actually Matters
A strong password on one site is undone entirely if the same password is on another site that gets breached. Attackers take credentials from one leak and try them everywhere, automatically, at enormous scale. It is called credential stuffing and it is the single most common way business accounts are taken over.
This is why reuse is worse than weakness. A mediocre password used in one place is safer than an excellent password used in five.
Which leads to the obvious problem. Nobody can remember forty unique long passwords, and pretending otherwise is how people end up with a spreadsheet called passwords.
The honest answer is that you should not try. Remember one strong password, the one that opens your password manager, and let it remember everything else.
A Strong Password You Can Actually Remember
For the two or three passwords you genuinely have to type from memory, the master password on your manager and the one that unlocks your laptop, use a passphrase.
Pick four or five unrelated words. Not a quotation, not a song lyric, not a phrase anyone else has ever written down. Something like copper lantern muddy piano. Add a number or a separator if a site insists.
Say it out loud a few times and type it a dozen times on the first day. Passphrases become muscle memory faster than random strings, which is the entire advantage.
Do not base it on anything guessable about you. Children’s names, pet names, your street, your car, your firm. Anyone targeting your business has read your website and your LinkedIn.
And never reuse the master password anywhere else, for any reason.
When To Change One, And When Not To Bother
Forcing everyone to change a strong password every ninety days is now understood to make things worse rather than better, because people respond by making small predictable changes and by writing the new one down.
Change immediately if you typed it after clicking a link in an email, if it appears in a breach notification, if you have used it anywhere else, or if you shared it with anybody. Those are real events and they need a real response.
Otherwise, a long unique password protected by multi-factor authentication does not need rotating on a calendar.
If your systems still force regular changes and it is driving people to bad habits, that is worth a conversation. It is usually a setting rather than a law, and the modern guidance supports removing it.
Related Guides And What To Have Ready
The natural next steps: using a password manager, which makes uniqueness practical, and multi-factor authentication, which protects you even when a password does leak. More in Accounts and passwords.
If you think a password has been exposed, tell us which account, roughly when, and whether that password was used anywhere else. That last answer usually determines how much work follows.
Call 678-374-4352.
The current federal guidance on passwords, including why length beats complexity, is published here: NIST SP 800-63B.
A Strong Password Checklist
Ten lines that replace everything you were told about passwords a decade ago.
- Length first. A strong password is long before it is complicated.
- Four or five unrelated words beats eight characters of punctuation.
- Never reuse a strong password on a second site.
- Do not base it on names, pets, streets or anything on your LinkedIn.
- Do not decorate an old password with a number and a symbol.
- Do not change Summer to Autumn every quarter.
- Keep one strong password in your head, your password manager’s master passphrase.
- Let a password manager generate and remember everything else.
- Turn on multi-factor authentication so a leaked password is worthless.
- Change a password immediately if you typed it after clicking a link.
If you take one line, take the third. Uniqueness protects you more than strength does.
Why A Strong Password Matters More In Your Industry
Attackers do not break in anymore. They sign in.
Law firms. A firm mailbox is a map of every client and every matter. One reused password on a breached site is all it takes, which is why a strong password policy at a firm is a confidentiality control rather than an IT preference.
Distribution and logistics. Distribution accounts touch pricing, customers and payments. A stolen credential here usually turns into an invoice fraud attempt weeks later, long after anyone remembers a password was reused.
Manufacturing. Manufacturing credentials often reach systems that were never designed to face the internet. A strong password plus multi-factor authentication is frequently the only control between a stolen login and something that matters.
If you want a password manager and MFA rolled out across the team, call 678-374-4352.
Questions About Choosing A Strong Password
Not if the password is long. Length matters far more.
A book locked in a drawer at home is safer than reusing one password everywhere. A sticky note on the monitor is not.
When there is a reason, not on a schedule.
Ask us at 678-374-4352 and we will check your domain against known breaches.