Online safety guide

How to Create a Strong Password (And Actually Remember It)

You don't need to memorise a wall of random characters. With a couple of small changes to how you think about passwords, you can be far better protected without making your life harder.

Why weak passwords are a problem

When a website gets hacked, attackers often end up with a long list of email addresses and passwords. They then try those same combinations on other popular sites, your email, your bank, your social accounts. If you reuse the same password (or a slight variation), one breach can quickly become several.

Short, common, or reused passwords also get cracked in seconds by automated tools. The good news: making a password much harder to guess is genuinely easy once you know how.

What makes a password strong

Length beats complexity

A long password is much harder to crack than a short, complicated one. Aim for at least 14 characters. A memorable phrase will outperform "P@ss1!" every time.

Unique for every important account

Your email, bank, and main social accounts each deserve their own password. That way, if one site is breached, the rest are safe. (A password manager does the remembering, see below.)

Avoid the obvious

Skip your name, birthday, your kids' or pets' names, your favourite team, "password123" or "qwerty". Anything someone could find on your social profiles is a poor choice.

The "three random words" trick

The UK's National Cyber Security Centre (NCSC) recommends using three random words joined together. They're long, easy to remember, and very hard to guess.

For example:

RedKettleBicycle
SunflowerMondayCheese
CoastalLanternPancake

Pick words that don't naturally go together, that's what makes the phrase unpredictable. To make it even stronger, drop in a number or symbol somewhere you'll remember (e.g. RedKettle7Bicycle!).

Password managers, your best friend

Honestly, this is the single biggest upgrade you can make to your online safety.

A password manager is an app that stores all your passwords in a secure, encrypted vault. You only need to remember one strong password, the one that unlocks the vault. The app then fills in the rest for you on websites and apps.

Most can also generate long, unique passwords for every site, so you never have to invent or remember them yourself.

Trusted, well-reviewed options include:

Bitwarden, free, open source, works everywhere
1Password, paid, friendly to set up, great for families
Apple Passwords or Google Password Manager, already built into your device, a great starting point

Read our full password managers guide

Add a second lock: two-factor authentication

Two-factor authentication (2FA, also called two-step verification) adds a second check after your password, usually a code from an app or a tap on your phone. It means that even if someone steals your password, they still can't get in.

Turn it on for the accounts that matter most:

Your main email, if someone can read your email, they can reset most of your other passwords. Start here.
Your bank and any payment apps (PayPal, Revolut, Monzo, Apple/Google Pay).
Social media accounts, especially anything tied to your work or business.
Cloud storage (iCloud, Google, Dropbox, OneDrive) where your photos and documents live.

Where possible, use an authenticator app (like Google Authenticator, Microsoft Authenticator, or your password manager's built-in one) rather than text-message codes, apps are more secure and work even without signal.

Your 5-minute action plan

Choose a password manager and install it.
Create one strong "master" password using three random words you'll remember.
Update your main email password first, and turn on 2FA.
Do the same for your bank, then work through your other important accounts.
Let the password manager generate new, unique passwords as you go, no need to rush, just update one or two a day.

How safe are your online habits?

Take the free 5-minute CyberSafe Coach check and get a personalised score with clear, practical next steps. No jargon, no scare tactics.

Start my free safety check

Your one habit from this lesson

Give your email, bank and main accounts their own password made of three random words, and let a password manager do the remembering.

Track your progress and earn XP

← Back to all guides