The Few Passwords You Must Remember: Length and Randomness

What you'll be able to do

Create a long, random passphrase for the few passwords you must memorize, and explain why length and randomness beat symbols and personal stories.

• Identify the handful of passwords you still need to keep in your head.
• Build a passphrase from randomly chosen words that meets current guidance.
• State the NIST length rules precisely, and explain why forced symbols add little.

The few passwords you still memorize

Once a password manager creates and remembers your passwords (Lesson 4.4), you no longer need to invent dozens of them. A few still have to live in your head, because they protect everything else:

• Your password manager's primary password, the one that unlocks all the others.
• The password or PIN that unlocks your computer or phone.
• Often your main email password, because email is the gateway for resetting your other accounts, as the UK's National Cyber Security Centre (NCSC) points out.

Where an account offers a passkey (Lesson 4.6), you may not need a password for it at all. For the few that remain, this lesson gives you one reliable method.

Length and randomness

Two things make a password hard to guess: length and randomness.

Length matters because every extra character multiplies the number of possibilities an attacker must try, a point the book makes clearly. Randomness matters because attackers do not try possibilities in order: they start with what people usually choose. A password is only as strong as it is unpredictable.

Randomness means chosen by chance, not by you. People are predictable, and attackers know the patterns:

• Personal stories built from pet names, family names or significant dates. The NCSC advises against these because such details are often findable on social media.
• Look-alike substitutions such as 0 for o or @ for a. The NCSC notes that these do not make a password significantly stronger, because criminals know the tricks, but they do make it harder to remember.
• Famous phrases, lyrics and quotes, which appear in guessing lists.
• Common passwords and keyboard patterns, which are always tried first.
• Any password printed as an example, which becomes public and therefore weak. The book makes this point too, and it still holds.

The current guidance, precisely

The US standard NIST SP 800-63B-4 (final, July 2025) sets rules for services that use passwords:

• A minimum of 15 characters when a password is used on its own as single-factor authentication.
• A minimum of 8 characters may be permitted when the password is one part of multi-factor authentication (a password plus a second step, Lesson 4.5).
• Services should accept passwords of at least 64 characters.
• Services should not impose composition rules, such as forcing a mix of capitals, numbers and symbols, because people satisfy them in predictable ways.
• Services must block common and already-breached passwords.

Read this carefully: NIST does not say every password must be 15 characters. The 15-character minimum applies when the password is the only thing protecting the account.

Other authorities agree on length and randomness. CISA recommends at least 16 characters and suggests a passphrase of several unrelated random words. The NCSC recommends "three random words" as a memorable starting point.

A simple personal rule that satisfies all three: for each password you must memorize, use four or more randomly chosen words. That comfortably passes 16 characters and is far easier to remember than a jumble of symbols.

Activity: build a passphrase

Practise the method first with a throwaway example, then create your real one privately. Never write your real passphrase in a course activity, share it or submit it; the only thing to note, privately, is that you have done it.

1. Choose words by chance. Open a book or dictionary at random pages and take a word from each, or let a password manager generate a random password for you. Do not pick words that mean something to you.
2. Use four or more unrelated words. Not a sentence, a lyric or a famous phrase.
3. Check the length. Aim for at least 16 characters in total.
4. If a site insists on a number or symbol, add one anywhere. That is the site's rule, not a strength trick. Keep the length.
5. Practise it a few times over the next day, then stop writing it anywhere it could be found.
6. Use it in one place only. A memorized password must be unique too.

Here is what the shape looks like. Because it is now printed in this lesson, it is public, so never use it: velvet orbit pepper lantern.

Real-World Example

Imagine Omar needs a new password for his email. He builds it from his daughter's name and birth year, swaps the letter a for @, and adds an exclamation mark. It meets an old "at least 8 characters with mixed symbols" rule, so the site accepts it, and it feels strong.

But his public profile shows his daughter's name, and a birthday post shows the year. Guessing tools routinely try names combined with years, standard substitutions and a symbol at the end. His password looks complex, yet it is predictable.

Omar starts again. He picks four words by chance from a dictionary, adds the single digit the site insists on, and practises the result for a day. The new passphrase is longer, has nothing to do with his life, and is easier for him to remember than the old one.

From the Book to 2026

What the book teaches. Chapter 11 shows how to turn a weak, memorable password into a strong, memorable one: encode a personal story, swap letters for look-alike symbols, use the initials of a sentence, sound-alikes, word separators or a line from a song or film, and aim for at least eight characters mixing letters, numbers and symbols. It also warns against common passwords, keyboard patterns and examples printed in tutorials.

Why it made sense. People were expected to memorize many passwords, and services commonly required eight characters with mixed symbols. Making a password both varied and memorable was the practical goal.

What has changed. Security guidance has evolved since the original text. Current guidance now recommends length and true randomness over personal stories and substitutions, because guessing tools model those human patterns. NIST SP 800-63B-4 sets a 15-character minimum for passwords used on their own (8 may be permitted as part of MFA) and tells services not to force composition rules. And because a password manager now generates most passwords, you only need to memorize a few. The book's warnings about common passwords, keyboard patterns and published examples remain current.

What to do now. Use four or more random words for the few passwords you memorize, let a manager generate the rest, and use passkeys where they are offered.

What Would You Do?

You are setting up a new account with a five-word random passphrase. The site rejects it with the message "Password must contain a number and a symbol."

What would you do? Decide, then check the note after the Knowledge Check.

Knowledge Check

Key Takeaways

• With a password manager, you only need to memorize a few passwords: the manager, your devices and often your email.
• Length and true randomness make a password strong; personal stories and look-alike swaps do not.
• NIST SP 800-63B-4: at least 15 characters when a password is used alone; at least 8 may be permitted as part of MFA.
• Four or more random words is a simple rule that meets NIST, CISA and NCSC guidance.
• If a site demands a symbol, add one; it is the site's rule, not a strength trick.

Further Study

Optional and external; not needed to complete the lesson.

• CISA — How to Make Strong Passwords!
• IBM Technology — How to make passwords more secure

Sources

• NIST — SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management
• NCSC — Three random words (Top tips for staying secure online)
• NCSC — Three random words or #thinkrandom
• NCSC — Top tips for staying secure online
• CISA — Require Strong Passwords
• CISA — Use Strong Passwords (Secure Our World; archived page)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 11