Back in 2011, I wrote a post about creating strong, memorable passwords. It recommended 8-10 character random strings, tools like PCTools.com, and celebrated that a password might take "12 years" to crack.

That advice is now dangerously outdated.

The landscape has shifted so dramatically that I'm not just updating the old post—I'm replacing it entirely. If you're still manually creating passwords for every account, you're working far too hard and probably less secure than you think.

The new default: stop trying to remember passwords

Here's the honest truth: for the vast majority of your online accounts, you shouldn't be creating memorable passwords at all. You should be using a password manager.

Password managers like 1Password, Bitwarden, or Apple's built-in Keychain generate genuinely random 20+ character passwords, store them securely, and fill them automatically. You don't need to remember "spava6AN!" for your Netflix account—you need a 24-character string of random gibberish that no human could ever memorise.

This isn't just convenience. It's security. The password manager generates something like k8#mP2$xL9@nQ4&vR7!tY3 for every site, and you never have to think about it again. No password reuse. No patterns. No "I'll just add a number to my usual password".

If you're not using a password manager in 2025, that's step one. Everything else is secondary.

When you still need memorable passwords

But there are situations where you genuinely need a password you can remember—one you can type without assistance:

  • Your password manager's master password — the one that protects everything else
  • Your device unlock codes — phone, laptop, tablet
  • Work systems that block password managers — some corporate environments restrict browser extensions
  • Backup or recovery scenarios — when you need to log in from a device that doesn't have your password manager
  • Shared household accounts — the Wi-Fi password, the Netflix profile everyone uses

For these cases, you need something both strong and memorable. And the approach has fundamentally changed.

Length beats complexity

In 2011, the thinking was: make it complex. Mix uppercase, lowercase, numbers, symbols. Keep it short enough to remember—8-10 characters.

That thinking was already being challenged by 2011 (one commenter on my original post pointed this out, correctly). The better approach—now well established—is length over complexity.

Consider these two passwords:

  • Tr0ub4dor&3 — 11 characters, complex, hard to remember
  • correct horse battery staple — 28 characters, four simple words, easy to remember

The second one is dramatically stronger. It's not close.

Why? Because brute-force attacks scale with the number of possible combinations. A longer password with a simpler character set beats a shorter password with a complex one. And crucially, you can actually remember it.

This is the "passphrase" approach, popularised by the XKCD comic that my 2011 commenter referenced. It works.

How to create a strong passphrase

Here's my current approach for the handful of passwords you genuinely need to memorise:

Pick four or five unrelated words. Not a sentence. Not a famous quote. Just random words that create a mental image. "purple elephant kitchen radio" works. "I love my family" doesn't.

Make it personal but unpredictable. You might include a word from a childhood memory, a place you've visited, an obscure interest—something meaningful to you but not guessable from your social media. "tungsten giraffe plymouth thursday" is better than "manchester united forever red".

Add one memorable twist. Maybe capitalise one word. Maybe include a number that means something to you but isn't your birthday. Maybe add a symbol between two words. This isn't strictly necessary for length-based security, but it satisfies systems that demand complexity—and some still do.

Aim for 20+ characters minimum. Four average English words will get you there easily. Five is better.

A password like Copper elephant 47 vienna! is:

  • 27 characters long
  • Contains mixed case, numbers, symbols, and spaces
  • Creates a memorable mental image
  • Would take astronomical time to brute-force

The two-factor imperative

Strong passwords are necessary but not sufficient. Any account that matters should have two-factor authentication (2FA) enabled.

This means even if someone somehow gets your password—through a data breach, phishing, or shoulder-surfing—they still can't access your account without the second factor. Usually that's a code from an authenticator app (better) or a text message (adequate).

For your most critical accounts—email, banking, password manager—consider hardware security keys like YubiKey. They're the gold standard.

Passkeys: the future arriving now

While we're here: passkeys are increasingly replacing passwords entirely for many services. Apple, Google, and Microsoft are all pushing this technology, and it's genuinely better—cryptographic authentication tied to your device, with biometric verification.

If a service offers passkey support, use it. You'll authenticate with Face ID or a fingerprint instead of typing anything. No password to remember, no password to steal.

This doesn't eliminate the need for a few strong memorised passwords (your device unlock, your backup codes), but it reduces how often you'll need them.

What about those "how long to crack" calculators?

They're mostly misleading. The estimates depend entirely on assumptions about attack methods, hardware capabilities, and whether your password has been compromised in a breach.

A password that would take "10 years" to brute-force on 2011 hardware might take hours with modern GPUs. And if your password (or a similar one) appears in a leaked database, the crack time is effectively instant—attackers check known passwords first.

Don't optimise for a calculator. Optimise for: using a password manager for everything possible, creating long passphrases for the few things you must remember, and enabling 2FA everywhere.

The takeaway

The best password advice in 2025 is to need fewer passwords. Let a password manager generate and store random gibberish for every account. Enable two-factor authentication. Use passkeys where available.

For the handful of passwords you genuinely need to remember—your master password, your device unlock, your backup access—create a long passphrase from unrelated words. Twenty characters minimum. Something you can visualise. "Copper elephant 47 vienna!" not "P@ssw0rd123".

The 8-character random string I recommended in 2011 was reasonable advice for its time. It isn't anymore. The good news is that the better approach is actually easier to remember.

This post replaces my original 2011 guide, which recommended approaches that are no longer adequate for modern security threats. The core insight—that passwords need to be both strong and memorable—remains true. But what "strong" means has changed dramatically.