The rules that actually hold
- Draw the words, don't choose them. Five words you pick ("mydogis cute") reflect your life and vocabulary; five words drawn uniformly from 1,316 give 51.8 bits whoever you are. Use the generator.
- Five words minimum, six for the crown jewels. Each additional word adds 10.4 bits and one more beat to the story you will picture.
- Memorize with a scene, not by rote. Link the words into one absurd image — the stranger the picture, the stickier it is. Rehearse by typing it at real logins for a week.
- Write it down — on paper, kept like a key. A new master passphrase on paper in a drawer at home is safer than a weak one in your head. Shred the paper once the phrase is truly memorized.
- Never decorate by hand. Capitalizing the first letter, swapping a→@, appending "!" and a birth year are the first shapes cracking rules try. If a rule forces a digit or symbol, let a random one be part of the draw, not a habit.
- One memorable password per secret. The email password and the master password must differ; if one is ever phished, the other still stands. A handful of scenes is memorizable — that is the entire budget, so spend it only where memory is truly required.
What does not work, however often it is advised
- Song lyrics, quotes, book lines: published text is in cracking dictionaries verbatim. If it exists in print, treat it as one dictionary entry, not as many words of entropy.
- Personal facts: pet names, streets, teams, anniversaries — findable, guessable, and reused across your other accounts.
- The "first letters of a sentence" trick: better than a word, worse than a passphrase — the sentence is usually a famous one or a predictable construction, and the resulting string is short and painful to type.
- Rotating variations: Spring2026! → Summer2026! is one password to any cracking rule set, however fresh it feels.
Test anything you plan to memorize in the strength
checker first — it deducts for common words, sequences and years, so a phrase that scores
well there after penalties is genuinely in decent shape. And re-check the plan against the
length guide: for a memorized secret, words are
how you buy length.
FAQ
How long until I can memorize a 5-word passphrase?
Most people have it after a few days of real use — typing it at unlock screens teaches it faster than drilling. Keep the paper backup until you have gone a full week without reaching for it.
Can I add my own word to a generated passphrase to make it personal?
You can, but count it as roughly zero extra bits if it is a word you would predictably choose (a name, a place). The five drawn words are doing the real work.
What about the passwords I must type on a TV or console?
That is a passphrase's home turf — see password vs passphrase. Words beat symbol-hunting on a directional pad every time.