Updated October 2026.

Even with a password manager, multi-factor authentication, or biometrics, you likely still need at least one password to memorize, whether as a backup or as the master password to your manager. I decided to use the mental space that passwords occupy to train myself to remember lessons of life, and in the process discovered that I could also remember complex passwords better.

For the few passwords that you type from memory, such as your password manager or your computer login, I would recommend this process. For everything else, let a password manager generate and remember a random password for you.

The process: start with the lesson, make it your own, and use the phrase itself as your passphrase. The following phrase was found using Tiny Buddha.

“Our vision is more obstructed by what we think we know than by our lack of knowledge.”

Make it personal. Don’t use a famous quote word-for-word. Attackers use lists of well-known quotes, lyrics, and proverbs, so a phrase anyone can look up is much weaker than it seems. Reword the lesson in your own voice; the rewording is what makes it harder to guess, and it also makes the lesson stick. Keep personal details out of it, though: names, places, and dates that someone could find on your social media make it easier to guess, not harder.

“What I think I know can blind me more than ignorance itself.”

Add a few random words. A sentence is more predictable than it feels: cracking tools try phrase lists with grammar and common word swaps, and a reworded quote is still a sentence. To make it strong, add two or three words chosen at random (roll dice against the EFF word list, or let your password manager pick them) that have nothing to do with the lesson. The lesson is the hook you remember; the random words are the part an attacker can’t predict.

What I think I know can blind me more than ignorance itself lantern oxide gravel

If a site caps the length: some apps and accounts cap passwords at an arbitrary length. If it’s a site you log into through your password manager, let the manager generate a random password at the maximum length; you never need to remember it. Only if you must type a capped password by hand should you convert your phrase into a shorter one. Reduce the number of words in the phrase to fit the limit; in this example the passphrase is 15 words, which fits a 15 character limit. Convert each word into a character to represent the phrase within the password, choosing characters that help you remember each word.

WITIKCBMMTIILOG

A string of first letters is still fairly predictable, so treat this as a last resort for the rare password you must type from memory, not as a strong password. Vary upper and lower case and mix in numbers and symbols where they help you remember a word, but don’t count on them for strength.

Wi7IK(8mMt!iLo6

Use it in exactly one place. Each memorized passphrase should protect one thing. Reusing a password is the biggest real-world risk: when one site leaks it, attackers try it everywhere else.

Protect it with a second factor. Turn on multi-factor authentication for the account your passphrase guards, preferably an authenticator app or a security key rather than text messages, and keep its recovery codes somewhere offline. Many sites now offer passkeys, which replace the password entirely; use them where you can, and you’ll need even fewer passwords to memorize.

Don’t change it on a schedule. Current guidance from NIST (SP 800-63B) is to change a password only when there’s a sign it’s been compromised; forced periodic changes lead to weaker, predictable passwords. That said, if a lesson has done its work and you want a new one, changing it is a fine excuse to learn something new.

Once the passphrase feels natural, start typing it out slowly while mentally saying the phrase to yourself 10 times. You’ll quickly fall into a groove by associating each word in the phrase with what you type… eventually the process will reinforce both the password and the lesson the more that you use it.