Creating a strong password should not mean trying to memorise an impossible jumble of letters and symbols. The most useful approach is to make passwords long, difficult to guess and different for every account — then use a password manager so you do not have to remember them all.
For a password you do need to remember, the UK’s National Cyber Security Centre (NCSC) recommends combining three random words. Here’s how to do that safely, protect your most important accounts and avoid common mistakes.
How to Create a Strong Password You Can Actually Remember
What makes a password strong?
A strong password resists guessing, whether the attacker is trying obvious combinations against a login page or testing stolen password hashes after a data breach. Three things matter especially:
- Length: longer passwords generally provide more possible combinations.
- Unpredictability: avoid popular phrases, personal details and common patterns.
- Uniqueness: each account needs its own password so a breach at one service does not expose the others.
A password such as Password123! may satisfy a website’s requirement for uppercase letters, numbers and symbols, but it remains easy to predict. Similarly, adding a birth year to a pet’s name does not make a strong secret.
The US National Institute of Standards and Technology (NIST) places greater emphasis on length and preventing the use of commonly known or compromised passwords than on mandatory combinations of character types. Its guidance for authentication services is not a universal rule imposed on every website.
How to make a memorable password using three random words
The NCSC recommends a straightforward method for creating a memorable password:
- Choose three unrelated words at random. Do not build a well-known expression, song lyric or sentence.
- Combine them into one password. Use spaces or separators if the website permits them.
- Check that the result is genuinely unpredictable. Avoid words linked to your name, family, birthday, address or favourite football club.
- Use it for one account only. Never reuse it on another website.
- Store it securely. If you must write a reminder down, keep it somewhere private and safe, not in a public note or message.
For illustration only, a passphrase might look like Lantern-River-Piano-Cloud. Do not use this published example as your password. Choose your own randomly selected words instead; examples copied from articles are not secret.
Read the NCSC’s official three-random-words advice for the underlying recommendation.
Passphrase or password manager: which should you use?
You do not need to invent a memorable phrase for every single website. In fact, a password manager is often the better solution when you have lots of accounts.
| Approach | Best use | What to remember |
|---|---|---|
| Three random words | A password you must type from memory | One long, unique passphrase |
| Password-manager-generated password | Most individual online accounts | Usually nothing beyond access to your manager |
| Passkey, where offered | Accounts supporting passwordless sign-in | Your device’s secure sign-in method and recovery arrangements |
Password managers can generate a different, unpredictable password for every service and save it in a protected vault. Built-in browser and device password managers can also be useful. Secure your password manager with a strong primary password and additional authentication where supported.
For example, you might use a carefully chosen passphrase to protect your password manager, while allowing the manager to generate long, random passwords for shopping, streaming and social-media sites.
Why you should never reuse passwords
Suppose you use one password for an online shop, your email and a social-media account. If the shop suffers a data breach, criminals may try the leaked email address and password on the other services. This is called credential stuffing.
Even a very strong password becomes a problem if you reuse it. Unique passwords limit the damage when one company suffers a security incident.
Protect your main email account first. Email often controls password-reset links for other services. Give it a strong, unique password and switch on two-step verification.
Add two-step verification to important accounts
Two-step verification (2SV), sometimes called 2FA or MFA, adds a further check when you sign in. Depending on the service, that might be a code from an authenticator app, a security key or another approved method.
If someone obtains your password, an extra verification step can still help keep them out. Not every method offers the same resistance to phishing, but enabling an available form of 2SV is usually a major improvement over relying on passwords alone.
Start with email, financial accounts and social media. The NCSC explains how to turn on two-step verification. For more detail, see our guide to what two-factor authentication is and why to use it.
What about passkeys?
A passkey is another way to sign in, using cryptographic credentials instead of a password you type. Where supported, you can often approve sign-in with your phone or computer’s device unlock method, such as a PIN or biometric check.
Passkeys are designed to resist common phishing attacks because the secret credential is not typed into a lookalike website. Account recovery and device protection still matter. If a trusted service offers passkeys, consider whether they suit your devices and recovery arrangements.
Do passwords need capital letters, numbers and symbols?
Some websites require a mix of character types, and you must follow their rules to create an account. But a common word with 123! added to the end can still be much easier to guess than a genuinely long, unpredictable password.
According to NIST’s current digital identity guidance, services following its standard should not impose arbitrary character-composition rules. For passwords used as the sole authentication factor, it specifies a minimum length of 15 characters for those services. That is guidance for organisations implementing the standard — not a claim that all shorter passwords everywhere are automatically unsafe.
The practical takeaway for individuals is to favour a long, unique and unpredictable password over superficial tricks.
When should you change a password?
You do not normally need to change a strong, unique password every month simply because time has passed. Repeated forced changes can encourage predictable patterns such as replacing Summer7! with Summer8!.
However, change a password promptly if:
- You learn it has been exposed in a data breach.
- You typed it into a suspected phishing website.
- Someone else may have gained access to it.
- You have reused it on another account.
- The service instructs you to reset it following a security incident.
Where possible, review recent sign-ins and account-recovery details, sign out unfamiliar sessions, and enable 2SV. NIST likewise advises against arbitrary periodic password changes while requiring changes when compromise is suspected.
Seven-minute account-security checklist
- Check your main email: does it have a unique password and 2SV?
- Check your password manager: is it protected and available on the devices you use?
- Find reused passwords: replace them with distinct, generated passwords.
- Review security warnings: act on alerts about exposed or weak credentials.
- Review recovery methods: ensure backup emails, phone numbers and recovery codes are current and secure.
- Update your devices: install important operating-system and browser security updates.
- Watch for phishing: check the site address before entering any credentials, especially after following an unexpected email or text link.
These checks tackle different risks. A VPN, for example, does not stop a fake website collecting a password you voluntarily type into it; see our explanation of what a VPN does — and does not do.
Common password mistakes to avoid
- Using a birthday, pet name, football team or another easily discovered detail.
- Reusing one password across multiple accounts.
- Using published sample passphrases from articles or videos.
- Assuming that a single symbol makes a short password strong.
- Sharing passwords in messages or entering them after an unexpected login prompt.
- Ignoring 2SV and important account-recovery settings.
Frequently asked questions
How long should my password be?
Longer is generally better when the password is unpredictable. The length permitted or required varies between services. A long random passphrase or a password-manager-generated password is usually a better choice than a short, familiar pattern.
Are three random words enough?
The NCSC recommends three random words as a practical way to create a memorable password. The words must really be random and unrelated; do not simply combine obvious personal details. Use a unique passphrase for each account.
Is a password manager safer than remembering everything?
For many people, a reputable password manager makes it substantially easier to use strong, different passwords for every account. Protect the manager itself carefully and understand its recovery options.
Should I change every password every 90 days?
Not simply because 90 days have passed. Prioritise replacing compromised or reused passwords, unless an employer or service requires a particular policy.
Is a passkey the same as a password?
No. A passkey uses cryptographic authentication rather than asking you to type a shared secret. It can provide stronger protection against common phishing techniques where the service supports it.
The bottom line
The best password is not necessarily the one with the most symbols. It is one that is hard to guess, unique to the account and protected by good sign-in practices.
Use three genuinely random words when you need a memorable passphrase. Use a reputable password manager for your other accounts. Give your email special attention, enable two-step verification and consider passkeys where available.
Sources: UK National Cyber Security Centre; NIST Digital Identity Guidelines. Reviewed for clarity and alignment with published guidance in October 2026.