With all the sites and programs that require you to have passwords, it is becoming a necessity to have a strategy for choosing good passwords that you can remember, yet are strong enough for protecting your sensitive information online.

You may have noticed that password rules vary from site to site. (I’ll talk about Web sites in this article, but this could just as easily apply to programs that run on your computer.) Usually, the strictness of the password rules increases with the sensitivity of the information being protected by the password.


Online banking sites usually require you to have at least 8 characters, including one upper case and one lower case character, and most require you to use at least one number or special character. There isn’t really a magic formula, but this is commonly accepted, and I call it the “Standard Strong Password” policy.
Obviously, banks need to make sure your password is not easily guessed by anyone. But they can’t do anything about it if you write down your password on a yellow sticky note and put it on your desk beside the computer. That’s why they have you read their terms and conditions, and make you agree to protect your password. This is your responsibility.

But what about online shopping sites? Do they need to use the same rules? It’s certainly not a bad idea for them to have the same rules, even if they don’t keep much sensitive information of yours. They may someday want to add value to their service, and it might require stronger protection. If they already require you to use strong passwords, they won’t have to inconvenience you later to change your password. For more information on setting password policies for an organization, refer to my article on “Password Policies” by clicking HERE.

Still, some sites don’t require anything but a minimum number of characters in your password. That shouldn’t stop you from using a stronger one if you want. The worst sites are ones that limit the number or types of characters you can use in your passwords (eg. 6 characters, and by the way you can’t use the “$” character..!). This begs the question, “How careful are they being with my information if they won’t allow me to put a strong password on my account?”

Assuming you are allowed to choose a strong password, what should you use? Ideally, you want something nobody else can guess, but these can be hard to remember. And what about using the same password on multiple sites? What if someone finds out the password you use on one site, and tries it on all of your sites? The reality is, with the number of sites you are registered at, you have probably used the same password in some of them. It almost makes the Internet unusable if you have to use a different password on each site.

You should also have a practice of changing your passwords every few months, or immediately if you think someone might know it.

With all of these conflicting requirements for a “perfect password”, where do you start? Based on the analysis done by Bruce Schneier (click HERE), here are a few tips I can provide, not for a “perfect” one, but a strong, manageable one:

  1. Choose a password “root” that is not a word found in a dictionary. Even the password “letmein” (let me in - without the spaces) is one of the most commonly used passwords. One of the best ways to choose a root is to think of a phrase you can remember (maybe from a passage in your favourite book), and take the first letter of each word. For example, using the phrase “You can’t have everything; where would you put it?…” (Stephen Wright… no relation) you could create the root “YcheWwypi”.
  2. Choose a numeric digit and a special character and place them in a random location in the string; even if they are side-by-side, although separating them will be stronger. For example, “Ych4^eWwpi”.
  3. If you are forced to change the password, just change the location of the number and special character within the root string of characters… “Yc4^eWwpi”
  4. I don’t recommend using a special character or number to separate dictionary words, such as “Dog2Cat”; or even substituting special characters for real ones, such as “Tru$tme”. These are easily guessed by password guessing programs (Click HERE for more information)
  5. Don’t use names and numbers or dates unless you intersperse the number within the name. “Jordan23″ is very common, but “J2or3dan” would be much stronger.

This strategy is just one of several that people use to remember strong passwords that can be used on multiple sites. The chances of someone guessing it are small, and even a sophisticated program would have a hard time identifying it.

Finally, don’t depend on the strength of the password to protect you. Never share it or leave it in plain sight. Contrary to popular belief, it is not a sin to write down a password. In fact, the strongest passwords used by high security organizations are written down, sealed in a tamper-proof envelope and stored in a safe. You may not have to go quite that far, but if you are prone to forgetting them, you are allowed to keep them in a secure location… as long as you can remember where it is.