Passwords You Can Actually Remember: Passphrases Explained

For years we were told a good password looks like Tr0ub4dor&3: a word with swapped letters and a symbol. It's hard to remember and, as it turns out, not that hard to guess. Password-cracking tools know every common swap.

Long beats clever

What makes a password strong is mostly how many possibilities an attacker has to try. Each extra character multiplies that number, so length matters far more than symbols. A passphrase of four or five random words, like orbit-velvet-cactus-lantern, is long, easy to picture and easy to type, and it beats a short jumble of symbols.

How to make a good passphrase

• Pick the words at random. A favorite quote or song lyric is easy to guess. Use a generator, or open a book to random pages.
• Use four or more words, five for anything important.
• Separate them with spaces or dashes if the site allows it.
• Never reuse it. One leaked site shouldn't unlock your other accounts.

Let a password manager remember the rest

Nobody can remember a different strong password for a hundred accounts. A password manager can. Make your manager's main password a strong passphrase, the one you actually memorize, and let it generate random passwords for everything else.

Turn on two-step sign-in

Two-step sign-in (also called 2FA) asks for a code from your phone or an authenticator app as well as your password. Even if a password leaks, the account stays locked. Turn it on for email first, since email can reset everything else.

Sharing a password safely

Need to give someone the Wi-Fi password or a shared account login? Don't leave it sitting in a group chat. Send it as a Secret Message, a link only someone with a second password can open. Its Make a strong one button creates a random password for you.

Check whether yours has leaked

Services like Have I Been Pwned list known data breaches. If an account of yours appears there, change that password, and any other account where you used the same one.