How to create a strong password (without having to remember it)

By The SyFly team · · 5 min read

What really makes a password strong, the habits that make one weak, and how to have a different one for every account. Every few weeks another website asks you to make a new password. Most of us reach for the same few: a pet’s name, a birthday, a favourite team with a number on the end. Those passwords feel safe because they’re personal. Unfortunately, that’s exactly what makes them easy to guess. Here’s what actually makes a password strong, and how to have one for every account without remembering any of them.

What makes a password strong?

Attackers rarely guess passwords by hand. They use programs that try millions of combinations, starting with the most common words, names, dates and patterns. A strong password is one those programs can’t reach in any reasonable time.

That last point is the one most people miss. When a website is hacked, the stolen emails and passwords are often tried on other websites automatically. If you reuse a password, one leak can open many doors.

  • Long. Length matters more than anything else: 16 characters or more is a good target.
  • Random. No words about you, and no keyboard patterns like “qwerty” or “123456”.
  • Unique. Used for one account only, so one leak can’t open the others.

Two good ways to make one

The best password is one you never have to remember.

Want to see one? Our free password generator makes one right in your browser, and the password health check tells you whether a password you already use has appeared in a data breach.

  • Let a password manager create it: A password generator makes a long, random password in a second, like kV7#qz!2Lm9@xR4t, and saves it for you. You never need to type it or remember it.
  • Use a passphrase for the few you type yourself: For the handful of passwords you need to remember, string together four or five random, unrelated words, like “orbit pencil tulip harbor”. It’s long, hard to guess and easier to type than a jumble of symbols.

Habits that make passwords weak

  • One password everywhere: If one website is hacked, every account that shares the password is at risk.
  • Personal details: Names, birthdays and addresses are easy to find on social media.
  • Small changes: Swapping Summer2025! for Summer2026! fools nobody, least of all a computer.
  • Sticky notes: Anyone who walks past your desk or your fridge can read them.

How SyFly helps

With SyFly you only need to remember one way in: the master password, passphrase, hardware key or face you choose to unlock your vault. Everything else is created and filled in for you.

  • A strong password for every sign-up. SyFly suggests one and fills it in.
  • Saved as you go. New logins are saved, and changed passwords are updated.
  • Filled in everywhere. In Chrome, Edge, Firefox and Safari, and in the SyFly desktop and mobile apps. See how autofill works.
  • Encrypted on your device. SyFly stores your passwords encrypted and can’t read them.

Questions

How often should I change my passwords?

Only when there’s a reason: a website you use has been hacked, you shared the password with someone, or you think someone else knows it. Changing strong, unique passwords on a schedule tends to push people towards weaker ones.

Is a long password really better than one full of symbols?

Usually, yes. Every extra character multiplies the number of possible combinations, so a long passphrase can be stronger than a short password full of symbols. A password that is both long and random is the strongest of all.

Do I still need to remember any passwords?

Just a few: the one that unlocks your password manager, and perhaps those for your computer and phone. Make those long passphrases you’ll remember, and let the password manager handle the rest.