Choose a strong passphrase you can remember and use everywhere

TL;DR — A strong passphrase is usually 4-6 random words with a small personal pattern you can repeat, not a short "clever" password with substitutions like "P@ssw0rd". The simplest reliable method is: generate several random words, join them into a phrase you can picture, save it in a password manager, and test it on one account before you reuse the method elsewhere. Reading time: ~5 min

Goal

When you finish, you will have one strong passphrase you can remember, a safe place where it is stored, and a simple method you can reuse for new logins without falling back to weak passwords.

Prerequisites

• Access to the account where you want to change the password
• Access to that service's password change page (usually Profile → Security, Account → Password, or Settings → Login)
• A password manager account or app you already use, or a notes app for a temporary one-time draft
• A browser on your computer or phone
• About 10 minutes without interruptions
• Optional: access to a trusted random word generator in your browser

Steps

Step 1: Open the password change page for the account

Use the account's settings page first. In most services, the path is one of these:

• Profile → Security → Change password
• Account → Login & Security → Password
• Settings → Password

If you do not see it, use the service's search box for "password" or "security".

What you should see when this succeeds: a form with fields like "Current password", "New password", and "Confirm new password".

Step 2: Generate 4-6 random words

In your browser, open a random word generator you trust and generate plain words. If the site offers options, use these literal values:

• Number of words: 5
• Separator: space
• Capitalization: lowercase
• Numbers: off
• Symbols: off

If your password manager can generate passphrases, use its passphrase option with these literal values instead:

• Type: passphrase
• Words: 5
• Separator: -
• Capitalize words: off
• Include numbers: off

Example output:

river lantern mint orbit velvet

What you should see when this succeeds: a list of ordinary words that do not form a famous quote, song lyric, or common phrase.

Step 3: Turn the words into one passphrase you can type reliably

Pick one exact format and use it. Copy one of these patterns exactly:

river-lantern-mint-orbit-velvet

river lantern mint orbit velvet

River-lantern-mint-orbit-velvet-27

Use these rules:

• Keep all original words in the same order
• Add only one simple pattern, such as one capital letter at the start or a 2-digit number at the end
• Do not replace letters with symbols like a → @ or o → 0
• Do not use your company name, product name, pet name, birthday, or city

What you should see when this succeeds: one passphrase you can read aloud and type the same way twice.

Step 4: Check that it is long enough for modern logins

Before saving it, count the approximate length. Use this quick rule:

If the service has password rules, match them literally. For example, if the page says "must include a number", use this exact style:

river-lantern-mint-orbit-velvet-27

If the page says "must include uppercase", use this exact style:

River-lantern-mint-orbit-velvet-27

What you should see when this succeeds: the new password meets the site's visible rules without becoming hard to remember.

Step 5: Save it in your password manager before you submit

In your password manager, create or edit the login item for this account and paste the exact passphrase into the password field. If your manager has a notes field, add one short memory cue that is not the password itself, for example:

5 random words, hyphens, capital R, ends with 27

If you do not have a password manager yet, use a temporary note for no more than 10 minutes while you finish the change, then delete it after saving the password in a manager.

What you should see when this succeeds: the account has a saved login entry you can autofill or copy later.

Step 6: Change the password on the account

On the password change form, enter your values in this order:

• Current password: your existing password
• New password: your new passphrase
• Confirm new password: paste or type the same passphrase again

Then select the page's submit button, usually labeled:

• Save
• Update password
• Change password

What you should see when this succeeds: a success message such as "Password updated" or "Your password has been changed".

Step 7: Sign out and sign back in once

After the change succeeds, sign out of the account, then go to the normal sign-in page and log back in using the new passphrase from your password manager first. Then, if you want, type it manually once.

Use the normal menu path for sign-out, usually:

• Profile → Sign out
• Account → Log out

What you should see when this succeeds: you can sign back in without a password reset, and the new password is the one your manager has saved.

Verify it works

Use all three checks below:

1. Sign out and sign back in with the saved password.
2. Open the account's Security or Login page and confirm the last password change time updated to today.
3. If the service emails security alerts, look for a message like:

Your password was changed

Expected result: you can log in successfully, the account shows a recent password change, and there is no need to use "Forgot password".

Common pitfalls

Using a famous phrase or lyric instead of random words

Mistake: choosing something like a movie quote, Bible verse, or song line.

Symptom: it feels memorable, but it is easier to guess than truly random words.

Fix: generate 5 new random words and use them in the exact order given.

Adding too many special rules and forgetting them later

Mistake: mixing capitals, symbols, and numbers in several places, like R!ver-Lantern9-M!nt-Orbit-Velvet.

Symptom: the password is accepted, but you cannot type it the same way later.

Fix: use one repeatable pattern only, such as Capital first letter + hyphens + 2 digits at the end.

Reusing one passphrase across multiple accounts

Mistake: setting the same passphrase on email, banking, work apps, and shopping sites.

Symptom: one breach can expose several accounts.

Fix: keep the same creation method, but generate a different 4-6 word passphrase for each account.

Trusting memory and skipping the password manager

Mistake: changing the password first and planning to save it later.

Symptom: you get logged out on another device and cannot remember the exact separators, case, or number.

Fix: save the passphrase in your password manager before you click "Change password".

Picking words tied to your life or company

Mistake: using your town, team, product, child, or pet in the passphrase.

Symptom: the password feels personal and memorable, but it is easier for someone to guess from public information.

Fix: use only random generator words, then add a typing pattern that is personal but not guessable, like hyphens and a final 2-digit number.

Forgetting that your most important account is email

Mistake: improving low-risk accounts first while your email still has an old weak password.

Symptom: password resets for other services remain exposed through your inbox.

Fix: change your email account password first, then your password manager, then your work and financial accounts.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.