Last year I locked myself out of my own VPS. Not because I forgot the password — I had it saved. Because the password I had saved was MyServer2024! and I'd changed it two months prior to something I'd generated randomly and forgotten to save.
I had to use my hosting provider's console access to reset it. The whole thing took 90 minutes and a lot of swearing.
The kicker: the password I thought I was using was terrible anyway. MyServer2024! follows the "something + year + symbol" pattern that cracking software hits in seconds.
I changed my whole approach after that day.
Why "Memorable" Passwords Fail
Everyone's instinct is to use something memorable. The problem is that memorable = predictable.
Cracking tools work by trying common patterns:
- Dictionary words
- Words + numbers (password1, welcome123)
- Words + years (Summer2024, Admin2025)
- Words + symbols (Password!, Welcome@)
- Leetspeak substitutions (P@ssw0rd)
Modern cracking rigs try billions of combinations per second. A password like MyServer2024! is guessed in under 5 minutes.
Length is the only reliable defense. A truly random 16-character password would take longer than the age of the universe to crack by brute force.
What I Use Now
Three categories of passwords:
| Use Case | Length | Character Set |
|---|---|---|
| Low-risk (forum accounts) | 12 chars | Letters + numbers |
| Medium-risk (email, admin panels) | 16 chars | Letters + numbers + symbols |
| High-risk (server SSH, database) | 24 chars | Everything + unique per server |
I don't try to memorize any of them. I store them in a password manager (Bitwarden, in my case).
The one exception: my password manager's master password. That one is 5 random words + a symbol, and I do memorize it.
How I Generate Them
Our password generator has three settings I care about:
- Length — I set 24 for server passwords
- Character set — all four toggles on (uppercase, lowercase, digits, symbols)
- Quantity — I usually generate 5 at a time, so I have spares
One important thing: the generator uses the browser's crypto.getRandomValues() API — the same source of randomness used by operating systems for cryptographic purposes. It's not Math.random() (which is not secure).
Why I Don't Use "Memorable" Passwords Anymore
There's a lot of advice online saying "use a passphrase like correct-horse-battery-staple." That's better than Password123, but not as good as truly random.
The reason: every published wordlist of passphrases gets added to cracking dictionaries. The more people use a style, the weaker it gets.
Random 16-character strings (like Kx9#mP2vL8@qR5nT) beat any passphrase for security. The only trade-off is you can't memorize them — which is why you need a password manager.
The Password Manager Workflow
Once you commit to a manager, everything changes:
- Generate a random 24-char password for each service
- Save it in the manager
- Never memorize it
- Use autofill to log in
- Use the manager's built-in generator when signing up for new services
I haven't memorized a password for any site in 3 years. Every single one is random and unique.
Common Mistakes I See
1. Reusing passwords
When LinkedIn got breached in 2021, 90% of the accounts I know that got locked out were because people reused their LinkedIn password elsewhere. Unique passwords per site = you're safe when one site leaks.
2. Using "clever" patterns
G00gl3! for Google. @maz0n! for Amazon. Cracking tools test these patterns first. Don't.
3. Storing passwords in browser
Browser password storage is encrypted but synced to your account. If someone gets into your browser account, they get every password. Use a dedicated manager with a master password.
4. Using the same password for "similar" things
Using one password for all your email accounts is the same as reusing it. If one email gets compromised, all of them do.
What About Two-Factor Authentication?
2FA is more important than password strength at this point. Even the strongest password can be phished. But 2FA stops 99% of credential-stuffing attacks.
My rule: any account that supports 2FA gets it enabled. Prioritize:
- Email (most important — this is your password reset hub)
- Banking
- Password manager
- Social media
- Everything else
Use an authenticator app, not SMS, if possible. SMS can be intercepted via SIM-swapping attacks.
How I Handle Server Passwords
For servers, I don't use passwords at all if I can avoid it. I use SSH keys:
- Public key on the server
- Private key on my laptop (password-protected)
- No password login allowed
This eliminates brute-force attacks entirely. An attacker would need my private key file AND my key passphrase.
When I do need a password (database, admin panel, etc.), I use the password generator and save the result immediately.
Generate One Right Now
If you need a strong password for any service, use our free password generator:
- Length: 4-128 characters
- Custom character sets
- Batch generate up to 50 at once
- Uses browser crypto API (真随机)
- Nothing uploaded to any server
Recommended settings: 16+ characters, all character sets on. Save immediately to your password manager.
Don't repeat my mistake. Randomly generated, unique per service, stored in a manager. That's the whole system.