A site tells you your new password needs a capital letter, a number, a symbol, and at least one character that doesn’t exist on a standard keyboard. So you type something like Tigers2024! and feel briefly clever, right up until you try to log in three weeks later and can’t remember whether you capitalized the T or added the exclamation point.
Most password advice fails here. It optimizes for rules a computer can check, not for something a human being can actually hold in their head. The result is predictable: people reuse the same password everywhere, write it on a sticky note, or fall back on patterns so common that guessing them isn’t much harder than guessing “password123.”
You don’t need to memorize gibberish to have a strong password. You just need to think about it differently.
Why complexity rules backfired
The advice to mix letters, numbers, and symbols came from a reasonable place: it makes passwords harder to guess. But in practice, it pushed people toward short, complicated strings that are hard to remember and, ironically, not always that hard to crack. Swapping an “o” for a “0” or adding “!” at the end are moves attackers’ tools already expect.
Length matters more than complexity. A longer password generally takes more effort to crack than a short one, even if the long one uses plain words. This is the idea behind passphrases: instead of a short, dense string, you use a longer sequence that’s easy for you to recall and hard for a computer to brute-force.
What a passphrase actually looks like
A passphrase is a string of random, unrelated words strung together. Something like:
correct-horse-lantern-window
or
purple42river!bicycle
The words don’t need to form a sentence or make logical sense together. In fact, random and unrelated is better, since “ILoveMyDog2024” is the kind of phrase a guessing tool will try early. Four or five unrelated words, especially with a number or symbol worked in somewhere, gets you a password that’s long and still something you can recall.
Why length beats complexity: Every additional character multiplies the number of possible combinations. A longer passphrase built from ordinary words can hold up better against cracking attempts than a short password full of symbols, and it tends to be easier to type correctly than a string of substituted characters and symbols.
Why randomness still matters: Don’t use song lyrics, movie quotes, or famous phrases. Attackers’ tools are loaded with exactly that kind of material. The strength comes from combining words in a way nobody would predict, not from the words being fancy.
Building your own passphrase
You don’t need special software to come up with one, though a password manager can generate them for you (more on that below). If you’re building one yourself, here’s a simple approach:
- Pick four or five words that have nothing to do with each other. Avoid names, birthdays, pets, or anything on your social media profile.
- String them together with a separator. Dashes, underscores, or a random number work fine: forest-camera-9-umbrella.
- Add a twist that’s yours alone. Capitalize a letter in the middle of a word, swap one letter for a number, or add a symbol somewhere that isn’t the first or last character.
- Make it long. Aim for at least 16 characters if the site allows it. Longer is almost always safer, and a passphrase gets you there without feeling like a chore to type.
- Never reuse it. A great passphrase used on every account is still a single point of failure. If one site gets breached, every account with that same password is exposed.
That last point is the one people skip most often, and it’s the one that causes the most damage. Reusing passwords means a breach at some company you barely think about can hand attackers the keys to your email, your bank, or your kid’s school portal.
Where a password manager comes in
Passphrases run into a real limit: even a great one becomes unmanageable once you have thirty accounts, all of which are supposed to have unique passwords. Nobody is memorizing thirty passphrases.
This is exactly what a password manager is for. It generates and stores strong, unique passwords for every account, so you only need to remember one strong passphrase, the one that opens the manager itself. If you’ve been putting off making the switch, What a Password Manager Actually Does, and Why It’s Worth the Switch walks through what it does day to day and why it’s worth the small adjustment period.
If a full password manager still feels like a bigger step than you’re ready for, passphrases you build and remember yourself are still a real improvement over “Tigers2024!” reused across a dozen sites. Either approach beats what most people are doing today, and even a partial fix is worth making.
A few habits worth building alongside this
Strong passwords do a lot of the work, but they’re one layer, not the whole fence. No password, by itself, makes an account unhackable.
Turn on two-factor authentication wherever it’s offered. Even a great password can be exposed in a breach you never hear about; a second step, like a code sent to your phone, makes it much harder for an attacker to get into your account with a stolen password alone.
Be extra careful entering passwords on public networks. Logging into sensitive accounts over open Wi-Fi carries its own risks. Keep your devices and browsers updated, too; security patches close holes that attackers use to steal saved passwords straight off a device.
None of this needs to happen at once. Start with the accounts that matter most: email, banking, and anything tied to your kids.
A password you can actually keep
The best password isn’t the one with the most symbols crammed into it. It’s the one that’s long enough to resist guessing, unique enough that a breach elsewhere doesn’t put everything else at risk, and simple enough that you’ll actually use it correctly instead of writing it on a sticky note under your keyboard. A passphrase built from a few unrelated words does all three, and it takes about the same effort as the password you’re using right now.
This is general guidance, not a substitute for a password manager’s own recommendations or professional security advice. Pick one account today, the one that matters most to you, and give it a real passphrase. Everything else can follow at its own pace.
A quick safety note
This article is general information, not professional security, legal, or medical advice. No single tool or setting makes anyone completely safe; security works in layers. If you are dealing with a live incident, such as active fraud, ransomware, or a child in danger, contact the appropriate professionals or authorities. For a threat to a child, report it to the NCMEC CyberTipline at report.cybertip.org and to local law enforcement.
