← Blog · Tech · 5 min read
How to make passwords you'll never need to remember
Most advice about passwords is either useless ("make it strong!") or impossible ("use a different complex one for every site and memorise them all"). The good news is that the modern answer is genuinely easy, once you stop trying to do it the hard way.
Why the old rules failed us
For years we were told to take a word, swap a few letters for symbols, and call it secure. "Password" became "P@ssw0rd". The trouble is that attackers' cracking tools learned those substitutions long ago, so the clever-looking version is barely stronger than the original. Worse, the rules pushed people to reuse the same handful of passwords everywhere, which is the real danger.
The two things that actually matter
Strength comes down to length and randomness. Each extra character multiplies the number of possible combinations, so a long random string is exponentially harder to crack than a short clever one. A genuinely random 16-character mixed password has about 37 nonillion combinations, against about 209 billion for 8 lowercase letters only. You can generate one in a second with our password generator, which runs entirely in your browser and never sends anything anywhere.
The part that makes it easy: a password manager
Here is the trick that changes everything. You are not supposed to remember dozens of random passwords — a password manager does that for you. You memorise one strong master password, and the manager stores and fills in all the rest. It will even generate them. Suddenly "a unique strong password for every site" goes from impossible to automatic.
Why uniqueness is the whole game
When a website gets breached — and they do, constantly — the stolen passwords get tried on other sites. If you reused yours, one leak hands attackers your email, your shopping accounts, maybe your bank. Unique passwords contain the damage to the one site that was breached. This single habit protects you more than any amount of symbol-juggling.
Add a second lock
Two-factor authentication asks for a second step — usually a code from an app — when you log in. Even if someone somehow gets your password, they cannot get in without that second factor. Turn it on for the accounts that matter most: email, banking, and anything tied to your money.
Why length beats cleverness, in numbers
The post's claim — that length and randomness are what matter — is arithmetic. Each extra character multiplies the number of possible passwords by the size of the character set, so the totals explode fast.
| Password type | Possible combinations |
|---|---|
| 8 lowercase letters only | about 209 billion (26^8) |
| 12 lowercase letters only | about 95 quadrillion (26^12) |
| 12 mixed characters (letters, digits, symbols) | about 476 sextillion (94^12) |
| 16 mixed characters | about 37 nonillion (94^16) |
Two lessons fall out of the table. First, length alone does enormous work: going from 8 to 12 lowercase letters multiplies the combinations by about 456,000, with no cleverness involved. Second, mixing character sets helps, but length helps more: a 12-character lowercase password already has about 95 quadrillion combinations, while a short mixed password with substitutions is exactly what cracking tools learned years ago. That is why "P@ssw0rd" is barely stronger than "password" — the substitutions are in every attacker's dictionary, so the clever-looking version is guessed almost as fast as the plain one. A genuinely random 16-character password, by contrast, sits at about 37 nonillion combinations, which is why the post says a computer would take an absurd amount of time to guess it. Generate one in a second with the password generator, and let a manager remember it.
What a breach actually does, step by step
When a website gets breached, the stolen passwords do not sit in a file — they get tried on other sites, automatically, at scale. This is credential stuffing, and it is the mechanism behind the post's warning about reuse. Step one: a forum or shop you barely remember leaks its password list. Step two: attackers try your email and that password against email providers, shopping accounts and banks. Step three: every account where you reused the password falls, even though none of those sites was breached. Unique passwords break the chain at step two: the leaked password opens only the site that leaked it, and nowhere else. That single habit — one unique password per site — protects you more than any amount of symbol-juggling, because it contains every future breach to one account instead of all of them.
The master password, and the second lock
The password manager solves the memory problem by reducing dozens of passwords to one: a single strong master password that you memorise, while the manager stores and fills in the rest and generates new ones on demand. The master password is therefore the one password worth making long and random, because it guards all the others — and it is the one password you should never reuse anywhere else. Two-factor authentication adds the second lock the post describes: a code from an app when you log in, so that even if someone somehow gets a password, they cannot get in without that second factor. Turn it on first for the accounts that matter most — email, banking, and anything tied to your money — because email is the recovery path for almost everything else: whoever controls your email can reset most of your other passwords.
Frequently asked questions
Is "P@ssw0rd" a strong password?
No. The substitutions it uses — @ for a, 0 for o — are in every cracking tool's dictionary, because millions of people made exactly the same swaps. It is barely stronger than "password" itself. Strength comes from length and randomness, not from making a common word look clever.
Do I really need a different password for every site?
Yes, because breaches are constant and stolen passwords get tried everywhere else. One reused password turns a breach at a forgotten forum into access to your email, shopping and possibly banking. Unique passwords contain each breach to the one site that leaked, which is why the post calls uniqueness the whole game.
Does two-factor authentication replace a strong password?
No, it complements it. Two-factor authentication is a second lock: even a leaked password alone does not open the account. But it does not fix reuse — a leaked password still opens every account that lacks two-factor authentication. Use both: unique long passwords everywhere, and the second factor on the accounts that matter most.
The takeaway
Stop trying to invent clever passwords. Generate long random ones with a password generator, let a password manager remember them, keep one unique password per site, and switch on two-factor authentication where it counts. That is less effort than inventing a clever password per site — and a 16-character random one carries about 37 nonillion combinations.