How to Build a Password You Can Actually Remember

The standard advice for passwords hasn't changed in twenty years: use a mix of upper and lower case letters, digits, and symbols. Make it at least 12 characters. Don't reuse it. The advice is correct, but it produces passwords that humans are terrible at remembering — so we write them down, reuse them across sites, or rotate through a handful of variations. Both habits are how accounts get compromised.

There's a better way, and it's been around since the 1960s. It just never caught on with the general public.

Why random passwords fail humans

A truly random 12-character password like 7K!mQ#vBp9$x has about 78 bits of entropy — strong enough to resist offline brute force for years. But humans can't memorize it. The brain isn't wired for random character sequences. Cognitive psychology research going back to Miller's famous "7 ± 2" paper shows that working memory holds roughly seven chunks of information at a time, and a random character is one chunk. So 7K!mQ#vBp9$x is already at the edge of what most people can hold.

When you can't remember a password, you do one of three things:

Write it down. The sticky note on the monitor. The text file on the desktop. Both defeat the password entirely.
Reuse it. Same password for email, banking, and that forum you signed up for in 2018. When one site leaks, all of them fall.
Use a weak pattern. Password123!, Spring2026!, your dog's name plus your birth year. These are the first things an attacker tries.

The passphrase alternative

In 1965, information theorist Claude Shannon showed that English text has roughly 1-2 bits of entropy per character — far less than the 6.5 bits a random ASCII character provides. That sounds bad, but it's irrelevant once you make the passphrase long enough.

The EFF published a Diceware wordlist in 2016 that contains 7,776 common English words. Each word represents about 12.9 bits of entropy. A six-word passphrase drawn from that list gives you about 77 bits of entropy — roughly equivalent to a 12-character random password, but vastly easier to remember.

correct horse battery staple (made famous by XKCD) is the canonical example. Four words, 44 bits of entropy, memorable enough that you probably still remember it from the cartoon. Six words pushes you past the safety line for any threat model short of state actors.

Why passphrases work for humans

The human brain is a story machine. We remember narratives, not character sequences. A passphrase like purple volcano cardboard telescope conjures a mental image — a purple volcano with a cardboard telescope stuck in it — and that image is sticky in a way that Pv7c!T2p will never be.

The research backs this up. Studies by Joseph Bonneau at Cambridge and others have consistently shown that six-word passphrases achieve the same brute-force resistance as 12-character random passwords, while taking users half the time to type and three times less time to memorize.

The catch: wordlists must be drawn from a cryptographically random source. Picking your own words biases toward familiar nouns (places, names, hobbies), which dramatically lowers entropy. Use a tool that pulls from a curated list using crypto.getRandomValues.

When passphrases aren't enough

Passphrases work brilliantly for password manager master passwords, disk encryption, and similar high-value secrets that you type occasionally. They're worse than random passwords when:

The site caps password length. Some legacy systems still cap at 16 or 20 characters. A six-word passphrase won't fit.
The site doesn't allow spaces. Some login forms strip them. Annoying, but common.
The password is used frequently on mobile. Typing "purple volcano cardboard telescope" on a phone keyboard is slower than 7K!mQ#vBp9$x would be with a password autofill.

For most everyday logins, the right answer is a password manager that generates and stores unique random passwords for every site. You memorize one strong passphrase — the master password — and let the manager handle the rest.

Generating strong passwords locally

Whatever method you choose, the security of the generated password depends entirely on the quality of the random source. JavaScript's Math.random() is not cryptographically secure — it's predictable if an attacker can observe enough outputs.

The Web Crypto API's crypto.getRandomValues uses the operating system's CSPRNG, which gathers entropy from hardware sources like interrupt timings, keyboard layouts, and CPU jitter. This is the same source used by TLS for session keys. It's what you want.

TextOpal's Password Generator uses Web Crypto under the hood, supports both random passwords (8-64 characters, configurable character classes, look-alike character exclusion) and EFF-style passphrases from a 240-word list. Everything runs locally — your generated passwords are never transmitted, never logged, never stored anywhere but in your browser session.

Practical advice for 2026

Use a password manager. Bitwarden, 1Password, KeePassXC — pick one and commit. Every site gets a unique random password.
Set a passphrase as your master password. Six random words from the EFF list. Write it down once on paper, store the paper in a locked drawer, then destroy the paper once you've typed it ten times.
Turn on two-factor authentication for anything important. Passwords alone are not enough anymore — even strong ones get phished.
Never reuse passwords. Even for "unimportant" accounts. Attackers use leaked credentials from low-value sites to try high-value ones, and they're alarmingly successful.

The one rule that matters

If you remember nothing else: length beats complexity. A 20-character password of all lowercase letters (correcthorsebatterystaple) has more entropy than an 8-character password stuffed with symbols (P@ssw0rd!). The latter feels secure; the former actually is.

Generate your next password with a local tool you trust. Stop reusing. Stop writing them on sticky notes. Stop pretending your birthday plus your dog's name is "good enough." It isn't, and it hasn't been for a decade.