"It must have a capital letter, a number and a symbol." The result: Company2024!, written on a sticky note on the monitor and reused for email, the bank and the invoicing software. It follows the rules, but it is exactly the kind of password attackers try first.
There is a better way, which is both safer and easier to remember: use phrases instead of single words.
Why "Company2024!" is not safe
People trying to get into your accounts do not guess by hand. They use programs that try millions of combinations per second, starting with the most likely ones: dictionary words, names, dates, years and the usual swaps ("a" for "@", "o" for "0", "!" at the end).
That is why what matters most in a password is not strange symbols but being long and unpredictable. An 8-character password full of symbols can be cracked much faster than a 20-character phrase made of simple words.
Method 1: the passphrase (4 random words)
Pick four or more unrelated words and join them with a separator. Then, to meet the rules most sites require, give them a personal touch: capitals at the start of the words, a number in the middle and a symbol as the separator.
- Giraffe-Brick7-Mustard-Violin
- Cloud.Sardine3.Bicycle.Clover
- key7_Pond_PIANO_cherry
The first example has 29 characters, capitals, a number and symbols (the hyphens), so it meets the usual rules. And it is easy to picture: a giraffe playing the violin on top of 7 bricks covered in mustard. Very hard to guess, very easy to remember.
Put the number and the symbol in the middle, not just at the end: "Phrase2024!" is the most predictable variation of all.
The secret is "random": the words must not form a well-known phrase or have anything to do with you. liverpool-champions-london-2024 is weak.
Method 2: the initials of a sentence only you know
Think of a personal sentence that is easy to remember and nobody else knows, and use the first letter of each word, keeping numbers and punctuation:
- "My first car was a blue Fiat I bought in 2009, in Coruche!" → MfcwabFIbi2009,iC!
The result looks random, but you only need to remember the sentence. It works well for the few passwords you really need to know by heart.
Mistakes to avoid
- Do not reuse the same password. If one site is breached, every account with that password is at risk. This is the most important rule of all.
- Do not use famous phrases, song lyrics, proverbs or quotes: they are on the lists attackers try.
- Do not use personal details: family names, birthdays, number plates, your company or football club.
- Do not keep passwords on sticky notes, in spreadsheets or in WhatsApp chats.
- Do not just change the number at the end (Phrase2024 → Phrase2025). It is the first variation that gets tried.
How many passwords do you need to remember? Very few.
Nobody can memorise 40 different passwords, and you do not have to. Ideally:
- Memorise 2 or 3 strong passphrases: your computer, your main email and a password manager.
- Let the password manager keep all the others. Bitwarden, 1Password or the manager built into your phone and browser create and fill in long, different passwords for every site.
- Turn on two-step verification for email, banking and your most important accounts. Even if someone finds out the password, they cannot get in without the code on your phone.
Need to send a password to someone?
Do not write it in an email or on WhatsApp, where it stays forever. Use our free Secure message tool: it creates an encrypted link that opens only once and is then deleted. And if you need a completely random password to keep in your manager, try our password generator.
If the password came to you by email, be suspicious first: check the 5 signs of a phishing email.
The 30-second summary
- Length matters more than symbols: aim for 16 characters or more.
- Use 4 random words or the initials of a sentence only you know.
- A different password for every account, kept in a password manager.
- Two-step verification on your important accounts.
Need help?
At aiodo we help small businesses get a website and business email that are secure and properly configured. If you want to review the security of your company's accounts, get in touch.
