A password you can actually remember and keep secure is usually a passphrase of four or more random unrelated words, not a single word with numbers swapped in. Something like correct horse battery staple style combinations are both longer and harder to guess than P@ssw0rd123, while being genuinely easier for a human brain to hold onto.
Why the old advice made passwords worse
For years, the standard advice was to swap letters for symbols and numbers, turning “password” into “P@ssw0rd”. This advice is now outdated, because attackers’ cracking tools have been trained on exactly this pattern for over a decade. Swapping an a for an @ does not meaningfully slow down modern password cracking software, but it does make the password much harder for a human to remember, which pushes people towards writing it down or reusing it everywhere.
Why length beats complexity
Password strength comes mostly from length, not from cramming in symbols. Each extra character multiplies the number of possible combinations an attacker’s software has to try. A long passphrase built from ordinary words is dramatically harder to crack by brute force than a short, symbol heavy password, even though it looks simpler to a person reading it.
How to build one properly
- Pick four or more words that have no logical connection to each other. Avoid quotes, song lyrics, or phrases from your own life that someone could guess or find on social media.
- String them together with spaces or a consistent separator, whichever the specific website or app accepts.
- Add one number and one symbol somewhere in the middle, not just tacked onto the end, since “ending in 1” is one of the first patterns cracking tools check.
- Avoid anything discoverable about you: pet names, birthdays, your football team, your street name.
An example structure, without using this exact phrase yourself, might look like: lantern-copper-whistle-42. Four unrelated words, a consistent separator, and a number that is not at the very end.
A memory trick that actually works
Picture the four words as a short, strange scene in your head, the stranger the better, since unusual images stick in memory far more easily than logical ones. “Lantern copper whistle” might become a picture of a copper whistle hanging from a lit lantern. The image does the memorising for you, rather than the letters themselves.
Why you should not use the same passphrase everywhere
Even a strong passphrase becomes a liability if it is reused across many accounts, since a breach at one site then exposes every other account using it. If remembering multiple different passphrases feels unmanageable, a password manager is a reasonable middle ground, letting you use one strong master passphrase to protect all the others rather than trying to hold every one in your head.
If you are unsure whether an existing account has already been compromised through password reuse, our guide on how to tell if your email was hacked covers the warning signs and what to do about it.
FAQs
Is a four word passphrase actually secure enough?
Yes, provided the words are genuinely unrelated and not a well known phrase. Length and randomness matter far more than complexity for resisting brute force attacks.
Should I still use different passwords for every single account?
Ideally yes, particularly for anything involving money or personal data. A password manager makes this realistic without needing to remember dozens of separate passphrases.
Do I need to change my passphrase regularly if nothing has gone wrong?
Current security guidance has moved away from forced regular changes, since they tend to push people towards weaker, more predictable variations. Change it only if you suspect it has been exposed.
