WiserHours
Menu

Follow your curiosity

Passwords that work · Lesson 2 of 11

Passwords You Can Remember: Three Random Words

Make a long password that is easy to remember and hard to guess, from three random words, and learn when you really need to change it.

FREE LESSON
Cover picture for lesson 2: Passwords You Can Remember: Three Random WordsVideo coming soon
The video is not out yet. The written lesson below has the same content.
THE WRITTEN LESSONFollow along at your pace

In this lesson, you will make a password that is easy to remember and hard to guess. It matters because a password that looks clever can still be one that attackers try first. The method is simple: three random words, nothing about you, and a different password for every account.

How attackers really guess

Attackers rarely start by trying every possible password. That would take far too long. Instead, they start with lists: common passwords like “123456” and “password”, everyday words, and passwords leaked from websites that were broken into. Then they add the usual tricks, like a number on the end.

So a password is weak if it is on one of those lists, or if it follows a pattern people often use. “Summer1” feels personal, but it is a common word with a number on the end, exactly what the lists cover.

An example red card headed List attackers try first: 123456, password, Common words and Leaked passwords, each with a small +1 tag. A red pill beside it says A number on the end.(opens the full-size picture)
Attackers start with what people have used before, then add the usual tricks.

Length beats symbols

You may have been told that a strong password needs a capital letter, a number and a symbol. Those help less than you think, because people add them in ways attackers expect. Someone told to make “password” stronger often writes “Password1!”, and attackers know it.

Length does more. Aim for 15 letters or more. An extra word adds more guessing work than a symbol stuck on the end.

A faded card marked Myth says A strong password needs a capital, a number and a symbol. Below it, the example Password1! is stamped Expected twice. A long blue bar passes a mark at 15 letters, with a pill that says Length does more.(opens the full-size picture)
Predictable symbols are on the attackers' lists; length is not.

Join three random words

To reach that length, join three random words, as Britain’s National Cyber Security Centre suggests. Pick words with no link to each other. For example, kettle, tulip and Saturn become “kettletulipsaturn”. That is long, and no list predicts it.

Choose your own words, not these. Any example you have seen in print, including this one, is a poor choice for a real password.

Three example word tiles, kettle, tulip and saturn, join into one example password, kettletulipsaturn. A length bar passes the 15 mark. A blue pill on top says Choose your own words, and a note credits three random words to Britain's National Cyber Security Centre.(opens the full-size picture)
Three unrelated words make one long password.

Make it stick

A picture helps you remember. Imagine a kettle boiling on the rings of Saturn, with a tulip in its spout. The odder the picture, the better it sticks.

Then type your new password a few times in its first week. A little practice early on makes it feel natural.

An example drawing of a kettle sitting on the rings of Saturn, steaming, with a tulip in its spout. Beside it, a password box, a First week calendar with three days ticked, and a pill that says Type it a few times.(opens the full-size picture)
A silly picture and a few practice runs help the words stick.

Leave out anything about you

Leave out birthdays, family and pet names, and the team you support. These details are often on social media, so a stranger may find them with little effort.

Skip swaps like a zero for the letter O, too. They barely help, because criminals know them, and they make the password harder for you to remember.

A social media profile with a birthday cake, a paw print and a team scarf, linked by dashed lines to a Leave out list: Birthdays, Family and pet names, Your team, and Swaps like 0 for O, all crossed out in red, with the example passw0rd crossed out. A pill says Nothing about you.(opens the full-size picture)
If it is on your profile, it does not belong in your password.

One password per account

A password that is hard to guess is no harder to steal. If one website leaks it, criminals try it on your other accounts. So give every account its own password. Then one leak stays one problem: the leaked password opens nothing else.

Remembering a different password for every account sounds impossible, and for most people it is. That is the job of a password manager, which remembers them for you.

A cracked old website leaks one key. Three locked doors, Email, Shopping and Bank, each have a key of a different shape, and the leaked key fails on them, marked with red crosses. A pill says One leak, one problem.(opens the full-size picture)
When each door has its own key, a leaked key opens nothing else.

Change it for a reason, not a schedule

You don’t need to change a good password on a schedule. Scheduled changes tend to be small ones, like “Tulip#2023” becoming “Tulip#2024”, and attackers can work those out.

Instead, change a password when something happens:

  • it was in a leak,
  • you shared it, or
  • you typed it into a page you now doubt.
A crossed-out reminder to change your password on a schedule, and a faded example, Tulip#2024, labelled Easy to work out. Below, under Change it if, three cards: It was in a leak, You shared it, and You typed it into a page you doubt.(opens the full-size picture)
Change a password when something happens, not when a calendar says so.

YOUR TURN

Read more

Read the full lesson script

In this lesson, you will make a password that is easy to remember and hard to guess. It matters, because a password that looks clever can still be one that attackers try first.

Attackers rarely start by trying every possible password. They start with lists of common words and leaked passwords, then add the usual tricks, like a number on the end.

That's why a capital letter, a number and a symbol help less than you think. People often add them in ways attackers expect. Length does more. Aim for fifteen letters or more.

To get there, join three random words, as Britain's National Cyber Security Centre suggests. Pick words with no link to each other, like kettle, tulip and Saturn. Choose your own, not these.

A picture can help you remember. Imagine a kettle boiling on the rings of Saturn, with a tulip in its spout. Then type your new password a few times in its first week.

Leave out anything about you. Birthdays, family and pet names, and the team you support are often on social media. And skip swaps like a zero for the letter O. They barely help, because criminals know them.

But a password that is hard to guess is no harder to steal. If one website leaks it, criminals try it on your other accounts. So give every account its own password. Then one leak stays one problem.

You don't need to change a good password on a schedule. Scheduled changes tend to be small ones that attackers can work out. Change it if it was in a leak, you shared it, or you typed it into a page you now doubt.

So, join three random words, with nothing about you. Give every account its own password, and change it only for a reason. Today, make a three-word password for your email. Next, you will meet a password manager, a tool that remembers a different password for every account.