Strong Passwords You Can Actually Remember: The Passphrase Method

The myths that made passwords weaker

For years, sign-up forms trained everyone into the same habits. Take a word, capitalise the first letter, swap an “o” for a zero and add “!” at the end. Attackers know those habits too. Password-cracking tools try dictionary words with common substitutions, years and trailing symbols long before they try anything random. The result looks complex to you and follows a pattern to them.

What the current guidance says

Two sources shape password advice in English-speaking countries, and they agree more than they differ. The US National Institute of Standards and Technology’s SP 800-63B-4 is written for organisations that run login systems. It says services shall require at least 15 characters when a password is the only thing protecting an account, and at least 8 when it’s one part of multi-factor sign-in. It says they shall not impose composition rules such as mixing character types, and shall not force periodic changes unless there is evidence of compromise. They should allow at least 64 characters, check new passwords against lists of common and breached ones, and allow password managers and pasting.

The UK’s National Cyber Security Centre speaks to individuals. Its advice is to use three random words. Avoid anything about you that could be found online, such as birthdays, pets, family or teams. Don’t bother with character substitutions, which it says add little and make the password harder for you to remember. It also says a password manager is a sensible way to handle the rest.

Put together, you get the method below. It’s the NCSC’s approach with the randomness made deliberate and the length matched to what the account protects.

Strong passwords you can remember, step by step

1. Get a word list and dice. The Electronic Frontier Foundation publishes a long list of 7,776 words for exactly this. Each word matches one five-dice result.
2. Roll five dice and read them as a number, say 43516. Look it up and write down the word.
3. Repeat until you have four words for an ordinary account, or five or six for the accounts that matter most.
4. Keep them in the order you rolled them. Resist swapping in a word you like better or reordering them into a sentence. Every choice you make puts back the predictability the dice took out.
5. Join them with spaces if the site allows, or hyphens if it doesn’t.

If you don’t have dice, the passphrase generator built into most password managers does the same thing. What matters is that the words are chosen at random, not by you. People asked to “pick three random words” tend to pick common, related words that fit together, like “blue sky morning”. A randomly picked set like “lantern gravy oyster” is what makes this work.

How many words is enough?

Here the arithmetic is simple enough to do yourself, and it’s honest in a way that “cracks in 3 trillion years” charts are not. With a list of 7,776 words, each randomly chosen word multiplies the number of possible passphrases by 7,776. Four words give about 3.7 quadrillion combinations. Six give about 2.2 × 10²³, which EFF states as roughly 2⁷⁷. An attacker who knows your exact method and word list still has to search that whole space.

For comparison, eight characters chosen completely at random from the 94 printable keyboard characters give about 6.1 quadrillion combinations. That is roughly the same as four words, and far harder to remember. How quickly an attacker could actually work through those numbers depends on how the website stores passwords, which you can’t see. Hence the sensible margin: four words for everyday accounts, five for email and banking, six for a password manager’s master password.

Making it stick

A list of unrelated words is hard to remember. A strange picture made from them is easy. Link the words in order into one scene: a brass lantern, full of gravy, with an oyster in it, bouncing on a pogo stick. The odder it is, the better it sticks. Keep the story in your head only. Don’t write the sentence down next to the password.

Then use it. Type it several times on the first day, picturing the scene as you go, and use it daily for the first week. Until it’s automatic, a written copy kept somewhere private at home is fine. The NCSC explicitly allows writing passwords down if you store them safely. What you shouldn’t do is keep it in a note on the same phone it protects.

Only memorise the passwords that unlock everything

Nobody can memorise a unique passphrase for a hundred accounts, and you don’t need to. Memorise the few that protect everything else:

• Your password manager’s master password. Six words. Most managers are designed so that they can’t recover it for you.
• Your main email. Five words. Every “forgot password” link for every other account arrives there. If you ever need to, our guide on recovering a hacked email account shows how much depends on it.
• Your phone’s account, whether Apple Account or Google Account. It holds backups, location and purchases.
• Your computer login, which you’ll type often enough to remember easily.

For everything else, let the password manager generate a long random password and fill it in for you. Uniqueness is the point. When a shop or forum is breached, and eventually one will be, a unique password means you lose one account rather than every account that shared it.

When a site won’t accept your passphrase

Check once, then stop changing it

Both phone platforms now check saved passwords against known breaches. On Android, Google Password Manager has a Password Checkup. On iPhone, the Passwords app shows security recommendations for leaked, reused and easily guessed passwords. Labels move between versions, so search settings for “password” if you can’t find them. Fix compromised passwords first, starting with any site that shared a password with your email, then reused ones.

To see which services have leaked your email address, a breach checker helps. Our guide on how to tell if your email was hacked explains how to read the results. Once a strong, unique passphrase is in place, leave it alone. Current guidance is to change it when there is evidence of compromise, not on a calendar.

Finally, a passphrase is one layer. Turn on two-step verification for email, your phone account and your password manager. Where a service offers a passkey, use it. A passkey can’t be typed into a fake login page or leaked in a breach. That still leaves a password underneath, protecting the account where your passkeys live. That one should be the best passphrase you own.

What a passphrase cannot do

A strong password protects against guessing and against breaches of other sites. It doesn’t help if you type it into a convincing fake login page. It doesn’t help if malware on your device records your keystrokes. And it doesn’t help if someone watches you enter it. Those are what two-step verification, passkeys and a healthy suspicion of unexpected login prompts are for. Nor does it help an account where the recovery email or phone is weaker than the password itself.

How this page was put together

The rules quoted here come from NIST SP 800-63B-4’s password requirements and the NCSC’s “Three random words” guidance, and the word-list figures come from EFF’s dice-generated passphrase page, all checked in September 2026. The combination counts are straightforward arithmetic, not estimates of cracking speed, which depend on how each service stores passwords. The dice rolls and example words are illustrations, and you shouldn’t use them.

We have no commercial relationship with any password manager mentioned or implied here. Our editorial standards explain how guides are researched and corrected.