Weak passwords are still the most common way accounts get broken into. Despite years of warnings, the most popular passwords in India remain things like "123456", "password" and a pet's name followed by a birth year. The problem is not that people do not care — it is that the usual advice (use a random mix of letters, numbers and symbols) produces passwords no human can remember. This guide shows a different approach: passwords that are genuinely strong and still possible to recall without writing them on a sticky note.
What makes a password strong
A password's strength comes down to one thing: how many guesses an attacker needs to crack it. That is driven mostly by length, not by complexity. A 16-character passphrase made of plain words is harder to crack than an 8-character mix of symbols and numbers. The maths is simple — every extra character multiplies the number of possible combinations.
A strong password has four qualities:
- Long — at least 12 characters, ideally 16 or more.
- Unique — never reused across accounts.
- Unpredictable — no names, dates, phone numbers or dictionary words on their own.
- Memorable to you alone — not written down in plain sight.
The passphrase method
The easiest way to build a strong, memorable password is to use four or five unrelated words joined together. This is called a passphrase. For example: blue-camel-window-pencil. It is 24 characters long, contains no personal information and takes seconds to type once you have used it a few times. To a computer it is extremely hard to guess; to a human it is a short story that sticks in the head.
To make it stronger, add a number and a symbol in a place you will remember: blue-camel-window-pencil7!. Avoid putting the number and symbol at the end every time — that is the first place automated tools try.
How to make every password unique
Reusing one strong password across sites is almost as bad as using a weak one. If a single site is breached, attackers try the same password on your email, bank and social accounts. The fix is to make each password unique without having to remember dozens of them.
One practical method is to take your base passphrase and add a short, consistent reference to the site. For example, for your email you might use blue-camel-window-pencil-EM, and for your bank blue-camel-window-pencil-BK. The base stays the same in your memory; only the ending changes. This is not as strong as a fully random password for each site, but it is far better than reuse and is realistic for most people to maintain.
The better answer: a password manager
If you are willing to take one step further, use a password manager. Apps like Bitwarden, 1Password and the one built into Google and Apple devices generate a unique, random password for every site and remember them for you. You only need to recall a single master password — which is where the passphrase method comes in.
A password manager solves three problems at once:
- Every account gets a strong, unique password without you thinking about it.
- You never type passwords by hand, which protects you from phishing pages that look almost real.
- You can audit which passwords are weak or reused and fix them in a few clicks.
What to avoid
Some common habits undermine even a long password:
- Personal information. Names, birthdays, vehicle numbers and phone numbers are the first things an attacker tries, and they are easy to find on social media.
- Keyboard patterns. "qwerty" and "12345678" take one second to crack.
- Slight variations. Changing "Password1" to "Password2" for a new site is not a different password — it is the same password with a predictable tweak.
- Writing it on a sticky note. A password on your monitor is visible to colleagues, cleaners and anyone passing by.
- Sending it by message or email. Even to yourself. If that account is ever accessed, the password is right there in the history.
Turn on two-factor authentication as well
Even the best password can be leaked in a breach you have no control over. Two-factor authentication (2FA) adds a second check — usually a code from your phone — so that a stolen password alone is not enough to log in. Turn it on for at least your email, bank and payment apps. It takes five minutes and removes most of the remaining risk.
A simple plan to fix your accounts today
If you have been reusing passwords for years, do not try to fix everything at once. Work through this order:
- Change the password on your primary email account first — it is the key to resetting every other account.
- Change your bank and payment app passwords next.
- Change your social media accounts.
- Install a password manager and start letting it generate passwords for new sign-ups.
- Turn on 2FA for the accounts above.
Strong passwords are not about cleverness — they are about length, uniqueness and a system you can actually maintain. Pick the passphrase method today, move to a password manager when you are ready, and you will not need to think about this again for a long time.