How to Create Strong Passwords — and Actually Remember Them

If your password is your dog's name followed by your birth year, you're not alone. Most people are in the same boat — and most people have no idea how exposed that makes them.

Passwords are the front door to your entire digital life. Your email, your banking, your photos, your social media. A weak password isn't just inconvenient if it gets cracked — it can mean someone else has the keys to everything.

Here's what you need to know, and exactly what to do about it.

What Makes a Password Weak?

Hackers don't sit at a keyboard guessing your pet's name. They use software that can try billions of combinations per second. A short, simple password gets cracked in seconds. A long, random one could take centuries.

The biggest mistakes people make:

• Using personal information — names, birthdays, addresses, pet names
• Reusing the same password across multiple accounts
• Using obvious substitutions — "p@ssw0rd" is not clever, hackers know that trick
• Using short passwords — anything under 12 characters is considered weak today

The scariest one on that list is reusing passwords. When a company gets hacked and their user database leaks — which happens constantly — attackers take those email and password combinations and try them on banking sites, email providers, and social media. If you used the same password everywhere, one breach unlocks everything.

And Please — Stop Writing Them Down

A sticky note on your monitor or a notepad in your desk drawer is not a password strategy. Anyone who walks into your home or office has instant access to every account on that list. If you need somewhere to write your master password as a backup, write it down once, keep it somewhere physically secure like a locked drawer or a safe, and never keep it near your computer.

What Makes a Password Strong?

A strong password is:

• Long — at least 12 characters, ideally 16 or more
• Random — not based on any real word or personal information
• Unique — used for one account only, never reused

A good example looks something like this: Kf8$mPqL2#nXw9vR

Nobody's remembering that. And that's exactly the point — which brings us to the solution.

What is a Password Manager?

A password manager is an app that generates, stores, and fills in your passwords automatically. You create one strong master password to unlock the app, and it handles everything else. Every account gets its own long, random, unique password — and you don't have to remember any of them.

It sounds simple because it is. And it's the single most effective thing the average person can do to improve their online security.

What About Google Password Manager?

This is where a lot of people think they're covered and they're not.

Google Password Manager — the one built into Chrome — is convenient, but convenience and security aren't the same thing. Here's the problem: everything is tied to your Google account. If someone gets into your Gmail, they get your passwords too. Your email is often the most targeted account you have, because it can be used to reset everything else. Handing it the keys to your entire password vault is a significant risk.

There's also a transparency issue. Google doesn't publish how their password manager encrypts your data, and their code isn't open for independent security researchers to audit. In the past, the company stored G Suite users' passwords in plaintext — not encrypted at all — which is exactly the kind of thing you'd catch with independent oversight. In July 2024, an update to Google Password Manager left between 15 and 17 million users unable to access or save passwords for nearly 18 hours.

Better Options

These are the password managers worth considering:

Bitwarden — Best free option
Open-source, independently audited, completely free for individuals. You can verify exactly how it handles your data because anyone can read the code. Free with unlimited devices, and just $10 per year for premium features. This is what we recommend to most people. bitwarden.com

1Password — Best paid option
Polished, easy to use, excellent on every device. Costs around $3/month. Great choice if you want something that just works beautifully and don't mind paying for it. 1password.com

Proton Pass — Best for privacy
From the same team behind ProtonMail. Free tier available, open-source, strong privacy focus. Good choice if you're already in the Proton ecosystem. proton.me/pass

What to Do Right Now

You don't have to overhaul everything today. Start here:

1. Pick a password manager — Bitwarden is free and a great starting point
2. Change your most important passwords first — email, banking, social media
3. Make each one unique — let the password manager generate them for you
4. Enable two-factor authentication on your email — this is a separate layer of protection that means even if someone gets your password, they still can't get in without a second verification step

That last one is worth its own article — and it'll be coming next month.