To create a strong passphrase, generate several unrelated words at random, keep the phrase long and use it for only one account. For most other logins, use a password manager to generate a different password for each service. A passphrase is most useful when you need to remember a credential that you can’t reliably autofill.
A phrase can look long while still being easy to guess. A song lyric, a familiar quotation or the names of pets and hometowns are predictable starting points. The selection method matters more than whether the finished words sound clever.
Choose a sign-in method you can maintain
| Situation | A practical choice | Why |
|---|---|---|
| You rarely type the login yourself | Let a password manager generate and store a long, unique password. | You can use a fresh random password for every account. |
| You need to memorize and type a password | Generate a long phrase of randomly selected words. | A sequence of words can be easier to recall. |
| The service offers a passkey | Consider enabling it and review account recovery. | A passkey can reduce dependence on a shared password. |
Generate the words before you try to remember them
Use a reputable password manager’s passphrase generator, or roll physical dice against a reputable word list designed for that purpose. Use fresh random selections for each word. The CISA guidance suggests five to seven unrelated words for a memorable phrase. NIST’s consumer guidance recommends at least 15 characters when you need to create a password. Using several randomly selected words usually puts you beyond that length.
If you find the sequence difficult to remember, create a private mental image after the words have been generated. The image is your memory aid. Choosing words to fit a story first usually makes the selection less random. Treat any passphrase printed in an article or tutorial as public.
Fit the phrase to the account’s rules
Check whether the sign-in form accepts spaces, what the maximum length is and whether special characters are required. If the generator offers a compatible separator, use it. If a site cannot accept your preferred phrase, have the manager generate a long random password within that site’s limits.
Update the credential from the service’s own account settings and check that the manager has saved it before you close the settings page. If you want to confirm it works, try signing in from another browser window while you still have access to the original session. Keep recovery information available in case you need it.
Make each account independent
One strong phrase used on several sites turns a single leaked login into a problem for the others. Start with email and any password manager vault, then replace reused passwords on accounts you depend on. Pay particular attention to the account you use to reset other passwords.
If a password has been exposed or reused, replace it with a fresh one. Adding a different year or suffix to a pattern you have used elsewhere preserves much of the old structure. A manager-generated password keeps you from having to invent a new pattern.
Add another layer of protection
Enable multifactor authentication where it is offered and review the account’s recovery options. A passkey or a hardware security key is worth considering where supported. For a password manager, learn how recovery works before changing its master credential. Keep recovery codes private and follow the service’s storage guidance.
A strong passphrase addresses guessing and reuse. It can still be exposed if you enter it into a fraudulent page. Open account settings from a trusted bookmark or the service’s app when you need to change a password.
Put it into practice on one account today
Choose one account that still has a reused or easily guessed password. Confirm your recovery options, create a fresh credential and turn on the extra sign-in protection the service offers. Then record which account you completed, without recording its actual password in a checklist.
For more background, browse BestDigiBooks’ Computer Security guide or see our guide to choosing practical nonfiction. The security recommendations here draw on NIST’s password guidance and CISA’s strong password tip sheet.
Frequently asked question
Should I change a unique passphrase every month?
Prioritize changing a credential when it is exposed, reused, or suspected of being compromised. Follow applicable workplace requirements for managed accounts. For personal accounts, check your recovery options and strengthen sign-in with a second factor where possible.
