EasyPasswords – Expert Advice on Creating Secure and Rememberable Passwords

Ask most people to invent a "random" password and they will produce something their brain finds comfortable — a pet's name, a birthday, a favourite team with a number tacked on. The problem is that comfortable is predictable, and predictable is exactly what password-cracking software is built to exploit. This guide focuses on the passphrase and, in particular, a method called Diceware that produces passwords which are genuinely random yet remarkably easy to remember.

Want expert help putting this into practice? EasyPasswords can guide you through it.

Why human-chosen passwords fail

Cracking tools do not start by trying every possible combination. They start with what people actually pick: common words, names, dates, keyboard patterns, and the predictable ways we "complexify" them — capitalising the first letter, swapping an "a" for an "@", adding "1" or "!" at the end.

Because human choices cluster around these patterns, a password that feels clever to you is often near the top of an attacker's list. The only reliable defence is true randomness — letting chance, not your brain, choose the ingredients. That sounds like it would produce something impossible to remember, but the passphrase approach shows otherwise.

There is a deeper reason human randomness fails: we are simply not built to be unpredictable. Studies of self-chosen "random" PINs, patterns, and passwords show the same clusters appearing again and again — dates, repeated digits, keyboard walks, and words tied to our lives. Attackers do not need to know you personally to exploit this; they only need to know that people in general behave this way. Outsourcing the choice to dice or software is not a gimmick, then. It is the one way to escape the statistical fingerprint that human minds leave on everything they try to make random.

The power of the passphrase

Related: easypasswords - complete guide.

A passphrase is simply several words strung together, such as cargo-blanket-quiver-mint. Its strength comes from length and randomness rather than from odd symbols. Four or five truly random words create so many possible combinations that brute-forcing them is infeasible, yet the result is a small story your mind can picture and hold onto.

The critical word is random. A passphrase made of words you chose yourself — "my dog loves long walks" — is weak, because it is a natural sentence an attacker's dictionary can assemble. The Diceware method exists to inject genuine randomness that your brain cannot.

How Diceware works

Diceware turns physical dice rolls into random words from a numbered list. It is low-tech on purpose: dice cannot be predicted or influenced the way a person's word choices can. The process is straightforward:

• Find a Diceware word list, where each word is tagged with a five-digit number.
• Roll a die five times and read the results in order — say 4, 2, 6, 1, 3 — to form the number 42613.
• Look up the word matching that number.
• Repeat until you have at least five or six words.
• Join them into your passphrase.

The result is a phrase like anvil-poster-ferry-lunar-crisp — chosen entirely by chance, impossible for an attacker to anticipate, and surprisingly easy to memorise because the human mind is good at remembering short lists of concrete things. A helpful trick is to build a quick mental image linking the words together into an absurd little scene — the sillier and more vivid the picture, the more firmly it lodges in memory, and within a day or two the phrase feels as natural to recall as a familiar phone number.

How many words is enough

See also: Easypasswords - Tips and Strategies for Secure Password Management.

Each word you add multiplies the difficulty for an attacker dramatically, so the number of words is the main lever on strength. A reasonable guide:

• Four words — adequate for low-stakes accounts, but on the light side for anything valuable.
• Five words — a strong general-purpose choice for most important accounts.
• Six or more words — recommended for the crown jewels: your email, your password manager's master password, and financial accounts.

Do not weaken the method after generating a phrase by dropping words because it feels long, or by swapping a randomly chosen word for one you prefer. The randomness is the whole point; editing it reintroduces the predictability you were trying to escape.

Using passphrases in real life

A Diceware passphrase shines for the one or two passwords you truly must memorise — above all, the master password to a password manager. Once that manager is unlocked, it can generate and store long random passwords for every other site, so you rarely need to memorise anything else.

That is the ideal division of labour: use a memorable Diceware phrase for the handful of gateway passwords, and let software handle the rest. A few practical notes:

• If a site imposes a maximum length or demands a number and symbol, add them at the end without removing any words.
• Never reuse the same passphrase across accounts — generate a fresh one for each of the few you memorise.
• Type your passphrase to practise it a few times right after creating it, so it settles into memory.
• If you must record it while it is still new, keep the note on paper somewhere private rather than in a file on your device, and destroy the note once the phrase is memorised.

Common mistakes to avoid

Even a good method can be undermined by small errors. Steer clear of these:

• Choosing words yourself instead of rolling for them — your brain is not a random number generator.
• Using famous phrases, lyrics, or quotes as a shortcut; these are the first thing attackers try.
• Making the words relate to you — your city, your children, your interests are all guessable.
• Stopping at too few words for a high-value account.
• Writing the phrase somewhere insecure, like a note on your desk or an unprotected file.

Done properly, Diceware gives you something rare: a password that is mathematically strong and yet sits comfortably in your memory. Roll for a five- or six-word phrase, use it to guard your password manager, and let the manager protect everything else. For a clear walkthrough of the method and how to build the rest of your security habits around it, EasyPasswords keeps the guidance simple and grounded in what actually works.