How to Create a Strong Passphrase You Can Actually Remember
A passphrase made of several random words is long, strong and easier to remember than a short jumble of symbols. Here is how to create one properly, and where you still need one.
Even if you use a password manager for everything, you still need to remember a few passwords: the manager's master password, your device login and perhaps your main email account. A passphrase made of several random words is the best option for these.
Why length beats complexity
A password's strength depends largely on how many possible combinations an attacker would have to try. Each extra character multiplies that number. A string of four or five genuinely random common words is far longer than a typical eight-character password with symbols, and much easier to remember and type.
The key word: random
Phrases you choose yourself, such as song lyrics, quotes or "ilovemydog2024", are predictable and appear in attackers' word lists. The words must be chosen randomly.
The diceware method
The Electronic Frontier Foundation publishes word lists designed for this, with instructions on its dice-generated passphrases page:
- Roll five ordinary dice and note the numbers, for example 4-1-6-3-2.
- Look up that number in the word list to get one word.
- Repeat until you have five or six words.
Physical dice guarantee randomness. Most password managers also include a passphrase generator that does the same job.
Make it usable
- Separate words with hyphens or spaces if the system allows: orbit-velvet-canyon-pickle-thunder (but not that one).
- Add a number or capital letter if a site insists, but do not rely on it for strength.
- Practise typing it a few times on the first day.
Where to use it
Use passphrases for the handful of passwords you must remember, and let a password manager generate random passwords for everything else. Turn on two-factor authentication for your most important accounts too.
Cover photo by Alexander Sinn on Unsplash.
