For the last twenty years, IT departments have forced us to create passwords that look like a random explosion of keyboard characters: P@s$w0rd!23. The theory was that adding numbers and special symbols made the password harder for hackers to guess. However, this outdated advice created a massive usability problem: these passwords are incredibly difficult for humans to remember, forcing users to write them down on sticky notes or reuse the same password across fifty different websites.
Modern cybersecurity experts now agree that length defeats brute-force hacking attempts much more effectively than complexity. By learning how to generate a strong password that you can actually remember, you can secure your most critical accounts without the headache of forgotten credentials.
The Problem with “Complex” Passwords
When a hacker tries to break into your account, they do not manually type in guesses. They use automated software that can guess millions of passwords per second. This software knows all the common human tricks.
If your password is Monkey1!, the hacking software will crack it almost instantly. It knows that humans capitalise the first letter, use common words, append a single number at the end, and finish with an exclamation mark. Substituting an “@” for an “a” or a “0” for an “o” no longer fools modern cracking algorithms.
The Solution: The Diceware Method
To create a truly secure password, you must use a string of characters that is incredibly long, but mathematically random so that hacking software cannot predict the pattern.
The most widely recommended technique for human-memorable security is the Diceware Method (often popularised by the webcomic xkcd). Instead of mashing random keys, you simply select four or five completely random, unrelated words and string them together.
An example of a Diceware password is: horse battery staple correct
Why is this so secure?
A password like horse battery staple correct is 28 characters long. Because it is so long, a brute-force computer program would take hundreds of centuries to guess every possible combination of letters. However, because it is just four standard English words, your human brain can easily visualise the phrase and type it quickly.
How to Generate Your Own Four-Word Password
The absolute most critical rule of this method is that the words must be completely random. You cannot use a famous quote, a lyric from your favourite song, or the names of your pets. If the words have a logical connection, hacking software will figure it out.
To generate your password, do not trust your own brain to be random. Use a tool:
- Physical Dice: The traditional method involves rolling a six-sided die five times to generate a number (like 4-1-6-2-5), and then looking up that number on the official open-source Diceware Word List to find a word. Repeat this four times.
- Digital Generators: Many reputable security organisations, such as the Electronic Frontier Foundation (EFF), host secure online generators that instantly spit out four random words for you.
When Should You Use This Method?
While this method is fantastic, you should not be memorising 100 different four-word phrases.
For 99% of your online accounts (like Netflix, forums, and shopping sites), you should use a dedicated Password Manager (like Bitwarden, 1Password, or Apple Keychain) to generate and store massive, impossible-to-read strings of gibberish.
You should only use the Diceware four-word method for the Master Passwords that you are forced to type manually from memory:
- The master password that unlocks your Password Manager.
- The password to unlock your Mac or Windows PC.
- The password to your primary email account (which controls password resets for everything else).
By securing these core accounts with a long, random, but memorable phrase, you drastically increase your digital security while lowering your daily frustration.
