How to Make Insanely Secure Passwords

How many times per day do you enter a username and password? Logging in to Facebook, checking your financials, leaving a comment at a random blog—there are tons of situations where access is restricted to authorized users. Clearly some sites are more important than others. Your bank password definitely outranks a password just used for blog comments. If you use a password manager, the master password that grants access to all the rest is the most important of all.

There are two conflicting requirements for a good, strong password. First, it should be nearly impossible for a hacker to guess. Second, it should be easy for you to remember (don't even think of writing the password on a scrap of paper!) A password that's a random collection of different characters and character types passes the first requirement, but most people would find it tough to memorize something like dK29e3EBwtY!WFp%. (That password came straight from the random password generator built into LastPass, our Editors' Choice for password management.) Most passwords that you can easily remember are also easily cracked… unless you use some simple mnemonic techniques.

For the Talented Typist

Are you a fast, accurate typist? Consider using a password that's an entire sentence, something with personal meaning. You'll have to practice typing without spaces, but after a while typing a password like JFK.1989.AskNotWhatYourCountryCanDoForYou! or Obama.2008.Yes,WeCanChange will come naturally.

Not a fan of politics? A favorite line from a movie, a poem, or a song can serve. Names and stats from a favorite sports match could combine to form a handy password mashup, like SteveYoung24-for-36@SuperBowl29. Just make sure to include at least one easily-remembered and relevant number, as well as some punctuation.

Shrink to Fit

Of course, not all password-protected apps or sites will accept passwords of unlimited length. You may find there's a limit, perhaps 12 or 16 characters. Fear not; you can still use a favorite saying, poem, or song lyric to create a cryptic but memorable password.

How about BBMshcDuhh!Fab4 for a password? That would be "Bang Bang Maxwell's silver hammer came Down upon her head!" boiled down to the first letter of each word, with uppercase letters for emphasized words, and Fab4 tacked on to provide a number. Shakespeare fan much? How about o,TtTtSFwM.A1.S2 ("O, that this too too solid flesh would melt", from Act 1, Scene 2 of Hamlet).

Common Sense

If your Facebook profile proudly proclaims that your favorite song is Sir Mix-A-Lot's "Baby Got Back," pick a different song as the source of your password. When you go to add numbers, don't use your house number, phone number, SSN, or anything a stranger could associate with you. Use a phrase or sentence that has personal meaning and you'll wind up with a password that's both memorable and unguessable.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio