How to build a password you'll never forget and no one can crack. No mnemonics, no poems, no password managers.
What a perfect password needs to be
- Hard to crack.
- Easy to remember.
- Easy to reconstruct if you do forget it.
- Usable on any site — even ones with stupid rules.
The system below hits all four. You can check any password's strength on Kaspersky's password checker.
What the system is
We'll walk through it on three sites: Facebook, Gmail, and this blog.
As a starting point, here's a password I used when I was 12:
sasha1996
Hackers would crack that in 3 minutes. It's easy to remember — but if they break one service, they instantly have every other one too. We don't want that, so we apply a system.
How the password is built
Step 1. Take the first 3–4 letters of the site
facebook → fac, google → goo, aletsu → ale.
Sometimes the name is two letters, like vk.com. Then you also take the first letter of the domain: vkc.
Step 2. Put digits on both sides
Assign digits to vowels and consonants. Say: consonant = 4, vowel = 5. Look at the outer letters and put the matching digit on each side:
4fac4
4goo5
5ale5
Step 3. A category letter in front
One letter for the type of service. Facebook — social = s. Gmail — mail = m. Aletsu — blog = b.
s4fac4
m4goo5
b5ale5
Step 4. The consonant count at the end
Count the consonants in the base and add that number. fac has 2, goo has 1, ale has 1.
s4fac42
m4goo51
b5ale51
Step 5. Add digits you'll always remember
At the end, put 4 digits you never forget — the last of your phone number, a birth date, a passport series. I'll use the year Moscow was founded, 1147:
s4fac421147
m4goo511147
b5ale511147
Step 6. Capitalise one letter
Many services have a dumb rule — one letter must be uppercase. It's a bad rule for usability, but there's nothing to be done. To keep it simple, capitalise one letter of the site name:
s4Fac421147
m4Goo511147
b5Ale511147
Check the result
All three came out at about 6 years to crack. We turned a 3-minute password into a 6-year one — roughly a million times stronger (1,051,200, to be exact).
The rule, in full
It's easy enough to remember — after a little practice; applying it on the spot takes a moment at first.
- Take 3 letters of the site, capitalise one.
- Put the vowel/consonant digits on both sides.
- Add the category letter in front.
- Add the consonant-count digit at the back.
- Finish with your four memorable digits.
By this rule, yandex, vk and mail come out as:
yandex — m4Yan421147
vk — s4Vkc431147
mail — m4Mai511147
Make it your own
- Take 4 letters instead of 3.
- Use different digits for vowels and consonants.
- Capitalise any letter you like — shift is just easier to hit at the start.
- End with any digits, in any amount.
What to do with this
If you like the system, change your passwords everywhere. It takes about 15 minutes, and you'll never again sit there straining to recall a password or hitting "reset".
Good places to start:
And don't forget your work email on top of your personal one — change that too.
Hopefully "how do I come up with a strong password" is no longer a question for you. Found a flaw in the system? Tell me what's wrong and how to fix it: Telegram.