How to create a good password you'll remember
1. Phrase it!
First you need to come up with a phrase you'll remember. It can be a line from a song, an old address, a favorite saying, basically anything you can write and remember. Then remove all the spaces. For example:
- Cupertino,CA95014
- GroundControlToMajorTom
- ToBeOrNotToBe
2. Scramble it!
By themselves, those are all really poor passwords, so they need to be scrambled.
There are dozens of ways to scramble the password, and you should use a few of them: Replace letters with other letters, numbers and punctuation; write parts or the whole backwords; use only the first (or second) letter of each word; type it one key to the left or right on the keyboard, etc.
The most important part of the entire process, however, is to make the scrambling deep enough. Replacing i's and o's with ones and zeros won't cut it, you need to be more cryptic and personal. It is best if some part of the scrambling relies on logic that makes sense only to you. So if you have a favorite coffee mug (a cup) that says World's Best Mom, you could replace the "Cup" in Cupertino with "WBM", so you get WBMertino.
Also, feel free to layer the encryption. Say you've decided to replace w's with "u2", Cupertino is suddenly u2BMertino. No person or script is going to guess the logic behind that.
So, our examples from above, may now be:
- u2BMertino,CAnfzof (u2BMertino is covered above. nfzof are the first letters in the spelling of the digits in the zip code: nine, five, zero, one, four)
- GrCoToMaTo (the first two letters in each word of the phrase Ground Control To Major Tom. Be aware, however, of passwords where the whole, or significant parts, are words that can be found in a dictionary, even accidentally, like tomato in this example.)
- B2toNrOB2 (To Be Or Not To Be -> 2 B Or Not 2 B -> 2BOrNot2B -> reversed)
3. Customize it!
You'll want a password you can use everywhere, but using the exact same password across all sites is a really bad idea.
Remember that almost every website that asks you for a password also has your e-mail address, and the combination of your e-mail address and password are your login credentials to Google/Gmail, Facebook, PayPal, Dropbox, etc.
So you want an easy way to create a unique password for each site you visit. The best way to do that, while still being able to remember it, is to use a letter from the name or address of the site to customize the password. For example, you can prepend your password with the last two letters of the domain name, so that your password is leB2toNrOB2 on Google, but okB2toNrOB2 on Facebook.
The challenge is not to be too transparent. It's not hard to guess how to change GoogPass from Google, into a password that would work for Facebook. Again, you want to apply a logic that makes sense to you, but not anyone else.
So, to use our examples with Google and Facebook, respectively:
- u2BMertino,oCAnfzof and u2BMertino,aCAnfzof (insert the second letter of domain after the comma)
- GrCoToMaToEl and GrCoToMaToKo (reverse the last two letters of domain and append them)
- 7B2toNrOB2 and 6B2toNrOB2 (prepend a number corresponding to the sitename's first letter's position in the alphabet. E.g. G for Google is the 7th, and F for Facebook is the 6th letter of the alphabet.)
4. Optimize it!
Finally, you should make sure your basic password complies with most common password requirements. Unfortunately, it is impossible to create a rule that covers all requirements, because different sites have conflicting requirements, but the most common ones are:
- Use both uppercase and lowercase letters: Many sites use case sensitive passwords. That means that uppercase (ABC) and lowercase (abc) letters are treated as different characters. E.g.: GrCoToMaTo is not the same as grcotomato or GRCOTOMATO.
- Password length: Many passwords need to be at least eight characters long. Some no more than sixteeen. Some need to be exactly eight characters long. Make sure your "standard" password complies.
- Special characters: Some sites require upper- and lowercase letters, some require numbers and letters, some also require special characters like punctuation (while some, probematically, won't allow them.)
For a site like Google.com, then, our example passwords will be:
- u2BM,onfzof (Shortened to eleven characters by removing "ertino" after "u2BM", i.e. "Cup"; upper- and lowercase letters, numbers, special characters)
- GrCo2Ma2El (Shortened to ten characters by replacing "To" with "2", upper- and lowercase letters, numbers, customization)
- 7toNrOB2 (truncated before "toN", i.e. after "Not", to be exactly eight characters, upper- and lowercase letters, numbers, customization)
That's it!
You've got yourself a password. Difficult to write? Don't worry, your fingers will get used to it, and soon you'll type hem automatically, without needing to remember the rules or logic that got you there.
The good part, however, is that no normal person can see through the logic of any of those passwords, and although you can never quite protect yourself against automated scripts, nobody can expect you to make it more difficult for evildoers to crack your password.
Even following this process, you'll want three or four different passwords, so it's not a total disaster if someone figures out your password rules. You'll want a basic one, and different ones for sites like your bank and PayPal, Facebook, Google and other sites you trust with lots of information.
There is no reason why the passwords can't somehow be related in your mind, however. For example, if your starting point for one password is "Ground Control To Major Tom", you can create new passwords from "Take Your Protein Pills" and "Put Your Helmet On" (the next two phrases in the same David Bowie song, Space Oddity).
Also, when you have the opportunity to register with a site using an existing account on a different website (like Google or Facebook), you should consider doing that. It'll not only be one less password to remember, but the authentication methods used are often safer than a plain username and password. However, it raises other privacy issues, with regards to what permissions you are granting the website, and you need to weigh those issues against each other.
