How to create strong passwords you can remember

It’s easy to create a strong password. Go to this free site and you’ll get examples such as .@v!TN8$8;i6E+F and \e4Y>19~>1LRb/C.

It’s also easy to create a password you can remember. Try 123456 or password. These were the most common passwords in 2017, and have been for several years running.

But it’s not so easy to create a password that is both strong and easy to remember. It becomes super difficult when you have dozens of passwords to remember.

Two options

You could use a password manager. It allows you to freely generate strong passwords without having to memorize them. I’ve been using an app called SplashID for many years now. I like that I can customize the fields and that it syncs across devices.

Honestly, if you’re in any sort of technology role, a password manager is the only hope you have of staying on top of everything. Between work, my parents, my kids, and my personal stuff I track over 400 passwords!

Or you could come up with a password convention that is both strong and easy to remember.

A password convention

Much like a naming convention, a password convention is just a consistent way of creating passwords. There are lots of ways to approach this, but here’s an example.

My password convention consists of three elements: a phrase, a target, and a rotator.

• Phrase. Think of a memorable phrase, then distill it to the first letter of each word. For example, “Oh how I hate Ohio State” becomes “ohihos.”
• Target. The target is the website or computer or file or whatever that requires a password.
• Rotator. The rotator is a way to handle targets that force you to change your password on a regular basis. It’s also a way to handle targets that force you to use numbers or symbols. A simple example would be “1%.” If it’s a password that changes quarterly, I would update the rotator to “2%” the next quarter, and so on.

Some examples

Here’s how this password convention would look in action.

Let’s say the target is Twitter. My password is ohihos-Twitter-1%. Note that I’m using a dash between elements. You can use any character, just know that many sites will not accept a space.

What would my password be for LinkedIn? Easy, ohihos-LinkedIn-1%. What about for Google? Simple, ohihos-Google-1%. My Apple ID? Got it, ohihos-AppleID-1%.

Why it’s easy to remember

Like any convention, it’s easy to remember because it is consistently formatted. In these examples, the first seven and last three characters are always the same. You don’t have to remember the target because, well, that’s what you’re staring at when you’re prompted for a password!

The only time it changes is when you are forced to change your password, but then you just increment the rotator. Worst case, you try entering an old password and it fails, so you try it again by adding 1 to the rotator. You’re in on the second try without having to consult a password manager.

Why it’s strong

Strong passwords must meet three criteria:

• Must use at least three of the four character types: lowercase, uppercase, numbers, and symbols. Basically, it creates a very large number of combinations.
• Must be at least 12 characters in length. Again, it creates a very large number of combinations.
• Must vary from target to target. On the super slim chance your password is cracked, it will not work on other websites in your browser history.

Did you notice that our password convention meets all three criteria? There’s no such thing as an un-crack-able password, but this convention gets you past 99% of the nosy losers trying to hack your accounts.

Final thoughts

I have a password convention (not this one, of course) that I use on all of the sites that store confidential information or pose a risk to my reputation. Think financial, medical, email, and social media.

Side note: The password on your G Suite account should be strong. Not only to protect yourself, but also because a compromise to one account has the potential to adversely impact everyone in the domain. I think of it as part of being accountable to others because I don’t want to be the reason our domain gets hacked!

Beyond that, I’m prone to repeating simpler passwords just like everyone else, but I sleep well knowing that nobody gains anything significant by hacking those accounts. 😉