How to Make Strong Passwords You Can Remember

A site asks for a new password with a capital, a number and a symbol, and you type a pet's name plus "123!" one more time. My mom in Garland still says the only rule is never write a password down, and that turns out to be half right.

Here is how long a password should be, why random words beat symbol soup, and how to track them all safely. The tour: my desk, left to right.

Stop 1: the notepad, left of the keyboard

Length comes first. CISA, the federal cyber agency, says at least 16 characters. NIST, the federal standards lab, sets 15 as the floor when a password works alone.

In plain English, a "passphrase" is a password made of words. CISA suggests 4 to 7 unrelated words. "Cactus lantern velvet orbit" is 27 characters and easy to picture.

• Skip: names, birthdays, teams. Much of that sits on social media.
• Skip: swapping "o" for "0". Attackers know it.
• Relax: NIST tells sites not to force symbol-and-number rules.

Hidden tip: let dice or a generator pick the words, not your brain. The EFF method uses five dice per word against a list of 7,776 words, and recommends at least six words. Spaces count too, and NIST says sites should accept them.

Stop 2: the laptop, center

Here lives the password manager: a program that creates, saves and fills in passwords. Many browsers and phones include one.

1. Remember one strong passphrase: the manager's.
2. Let it generate a different password for every other account.
3. Let it autofill. NIST says sites must allow password managers.

Why one per account? A breach at one site opens every account that shares its password. The Pwned Passwords service tells you if it has leaked, and only a short piece of a scrambled version ever leaves your device.

Stop 3: the phone, right of the laptop

The second lock. With a code or prompt on your phone as a second step, NIST allows passwords as short as 8 characters.

When a site offers a "passkey," take it. In plain English, a passkey signs you in the way you unlock your phone: face, fingerprint or PIN. The FIDO Alliance, which sets the standard, calls it phishing-resistant.

Stop 4: the top drawer

One labeled envelope, because my label maker gets everything. It holds the manager's passphrase and any backup codes my accounts gave me. Mom's rule gets an update here. The UK's cyber agency says writing a password down is OK if you keep it somewhere safe. A drawer, not a sticky note on the screen.

The problem corner: old security questions

The ticket I'm not proud of: old accounts that still ask "favorite food?" Google researchers found one guess cracked English speakers' favorite food answer nearly 1 time in 5. Made-up answers were forgotten more often.

Hidden tip: answer with a random phrase and save it in your manager as a note.

Copy this, easiest first

Looking back from the drawer, one rule runs the desk: remember one thing, store the rest.

1. Change your email password to a passphrase. Resets for other accounts usually land there.
2. Turn on the second step for email and banking.
3. Move other accounts into the manager, one at a time.

Save this: passwords at a glance