How to Choose a Password You Can Keep

You will not remember a different strong password for every account, and you should not try. The accounts that matter are email, banking, and anything that can reset the others. Those need long random passwords stored in a password manager. I generate them with the password generator in the browser, then I put them in the manager before I close the tab.

What actually makes a password hard to guess

Length first, randomness second, cleverness never. A sentence a stranger could read on your profile is not a password, even with a 1 instead of an i. Attackers do not sit and think about your pet. They try lists of passwords other people already used, and they try fast guesses built from those lists.

A random 16-character password is not on those lists. You cannot remember it. That is why the manager exists. The manager's one password, the one you do memorise, should also be long. A passphrase of several random words is easier to type on a phone than a string of symbols, and it can still be strong if the words were chosen at random and there are enough of them.

A setup that survives a normal week

1. Install a password manager you will actually open. The best system is the one you use.
2. Put the email account in it first. That inbox is the key to every reset link.
3. Generate a new password for the email account. Save it. Sign in. Save the recovery codes the provider gives you, on paper or in the manager, not in the same email.
4. Turn on two-factor authentication for email and for the bank. An app or a hardware key is better than SMS if the provider allows it. SMS is still better than nothing.
5. Replace reused passwords as you touch each account. You do not have to do fifty in one night. You do have to stop adding new accounts to the old reused password.

The generator should be set to at least 16 characters, with letters, numbers, and symbols, unless the site is badly built and rejects symbols. If it rejects symbols, use a longer password without them. Do not "simplify" a generated password so you can remember it. That throws away the point.

The annoying sites

Some forms limit you to 12 characters, or ban symbols, or silently truncate. That is their bug. Use the maximum they allow, random, and turn on two-factor if they have it. Do not reuse the bank password there to "make up for" their limit.

If you must share a password with one other person, share it through the manager's sharing feature or read it out, and change it when the sharing is over. Do not send it in the same email as the username if you can avoid that.

A PDF you email can take a separate password from Protect PDF. Generate that password too, store it next to a note of the file name, and send the password in a different channel from the file.

What I stopped doing

I stopped changing passwords on a calendar if nothing leaked. I change them when there is a reason: a breach notice, a shared password, a laptop I no longer trust. I stopped storing passwords in the browser on a computer other people use. I stopped answering security questions with real facts. Those answers are public if you ever talked about your first school. The manager can store a random answer if the site forces the question.

The generator never sees a server-side copy of the password, because it runs on the page you already opened. That does not remove your job. If you generate a password and do not store it, you have locked yourself out. Generate, save, then use it. The manager is the product. The generator is how you stop typing your birthday.

After a breach notice

If a site emails you that passwords leaked, change that password and any account where you reused it. Start with email. Do not click the link in the email until you have opened the site yourself by typing the address or using a bookmark. Phishing borrows the same moment. Generate the new password in the manager, save it, then paste it into the site you opened yourself. A breach is not a reason to go back to a shorter password you can "finally remember". It is a reason the manager exists.

Write down the recovery codes when the site shows them. They are the way back in when the phone with the authenticator app is gone. Store them with the same care as the password, not in a screenshot in the camera roll you also share with a family tablet. If the only copy of the recovery codes is a photo on a shared tablet, move them today. A password manager that you cannot open because you forgot its master password is a different problem: write that one passphrase down and keep the paper somewhere boring and physical. Digital memory is not the backup for the thing that opens your digital memory.