How to remember passwords without writing them down
Don't try to remember all your passwords. Nobody can do that safely. Memorize a few that matter, make them long, and let a password manager handle the rest.
Decide what's worth memorizing
Most people only need to keep two or three secrets in their head:
- The master password for your password manager
- Your main email password, because email can reset almost everything else
- The login for your computer or phone
Everything else should be a random password that your manager generates and you never see. Current NIST guidance explicitly requires sites to allow password managers and autofill.
Go long instead of complicated
The old advice to mix in symbols and change passwords every 90 days is gone. NIST now says sites shall not impose composition rules or force periodic changes, unless there's evidence a password has been compromised. Where a password is your only login factor, it requires at least 15 characters.
That's good news for your memory, because length is easier to remember than complexity. A passphrase of random words fits the rule easily and is far easier to hold onto than Tr0ub4dor&3.
The word "random" matters. Song lyrics, quotes and family names are exactly what attackers try first. Pick words with dice or a generator, like the EFF's dice method. Six words from its 7,776-word list gives you about 77 bits of entropy, and there's no clever pattern for an attacker to guess. Some sites may still demand a number or symbol, so add one in the same place each time.
Make it stick with a memory palace
Random words are hard to remember because they don't mean anything together. The memory palace technique fixes that by giving each word a place. Here's how it works with a sample passphrase, which you shouldn't use now that it's been published: velvet harbor cactus lantern orbit pickle.
- Front door: it's upholstered in red velvet, and your hand sinks into it.
- Hallway: the floor is flooded, and tiny ships are docking in a harbor.
- Living room: a cactus is sitting on the couch, watching TV.
- Kitchen: a lantern swings from the ceiling, dripping oil onto the stove.
- Stairs: a small moon is in orbit around the banister.
- Bedroom: a giant pickle is tucked into your bed.
Walk the route a few times today, tomorrow and later this week, and type the passphrase each time you do. Use a different route for each passphrase, so the images don't get mixed up. The route and images stay in your head, so don't write them down either.
Have a backup
Human memory fails, particularly for a password you rarely use. For your master password, keep a paper copy in a physically secure place, like a safe. Written down at home, it's safe from nearly everyone who's realistically trying to break into your accounts online. For accounts that offer them, store your recovery codes the same way.
Turn on stronger login where you can
Add a second factor to the accounts you've memorized passwords for. Better still, use passkeys where they're offered, because a passkey can't be typed into a phishing site the way a password can, however well you've memorized it.
What if the password was a place?
Password Palace starts from the same spatial memory: instead of turning a place into a string of words, the place itself becomes your login. You design a 3D room, and rebuilding it is how you sign in. It's early, and it's still a secret you enter from memory, so the phishing caveat above applies. Try the demo and see whether a room sticks better for you than a string of words.