My Personal Rules for Making Complex Passwords I Can Remember

Hi, I'm Shingo Suzuki, also known as Suzushin.

Once, thinking about security, I tried to make a password as complicated as possible. I mixed uppercase and lowercase letters, numbers, and symbols randomly and thought it looked secure.

A few days later, I couldn't remember it myself.

Making a password look complicated doesn't necessarily make it secure. And if I can't remember it, I end up repeatedly resetting it. Here's the memorable-but-complex approach I've been using since that experience.

This is a personal workaround, rather than a generally recommended way to make secure passwords. I'll also cover the risks of shared rules and recommended password management practices.

Complexity and memorability can go together

Trying to memorize random strings is what makes them hard to remember.

Instead, I keep one personal set of rules and reconstruct a password from it each time. Remembering the rules means I don't have to memorize each individual password.

How my rules work

Publishing my actual conversion rules would itself create a security risk, so these examples only illustrate the idea. They aren't the rules I really use.

The approach is to transform one memorable sentence step by step:

1. Choose a memorable sentence: For example, “My favorite 四字熟語 is 試行錯誤.” The Japanese expressions refer to four-character idioms and trial and error.
2. Take English initials, capitalizing only the first: My favorite becomes Mf, and is becomes i, giving Mf四字熟語i試行錯誤.
3. Transform the first Japanese expression by a personal rule: Convert 四字熟語 to 41095, producing Mf41095i試行錯誤.
4. Transform the second expression: Convert 試行錯誤 to 4K0u395, producing Mf41095i4K0u395.
5. Add symbols at both ends: For example, !Mf41095i4K0u395@.
6. Prepare an abbreviation for the service: For Amazon, perhaps amzn.
7. Shift that abbreviation one key to the right instead of using it directly—an illustrative example: The service abbreviation is the easiest part to associate with a particular service. Rather than append it unchanged, replace each letter with the keyboard key to its right. For amzn, a→s, m→,, z→x, and n→m gives s,xm. Append it to get !Mf41095i4K0u395@s,xm.

If the original sentence is memorable, I can recall the starting point and rebuild even a long string without much trouble. The service is less apparent from the result, while I only need to move one key right rather than memorize something new. Using Shift to turn , into < would give s<xm and add another symbol.

Although the output looks random, I remember only a few rules: the sentence, English initials, Japanese substitutions, symbol placement, service abbreviation, and keyboard shift. Once those rules become familiar, I can assemble the password for a service on the spot.

I also want enough length

Alongside complexity, password length matters. Making a password longer is often said to improve strength more readily than increasing character varieties.

A longer starting sentence or additional Japanese words naturally increases the final length. Being able to do that while keeping the starting point memorable seems a good fit for this approach.

Other examples

You can decide your own substitution rules. Here are two more illustrative examples, again shifting service abbreviations one key right:

• Start with 夢中 (muchuu, being absorbed in something) → romanize as muchuu → capitalize and insert preferred numbers: M2ch9 → add symbols: #M2ch9! → append the shifted Rakuten abbreviation rktn: #M2ch9!tlym.
• Start with 一期一会 (ichigo ichie, a once-in-a-lifetime encounter) → take romanized-part initials: igie → add capitals and fixed digits: IgIe73 → add a separator: IgIe73\_ → append shifted Twitter abbreviation twtr: IgIe73_yeyt.

Which parts become numbers or symbols, and where symbols go, is up to you. With this approach, using the same rules to reconstruct passwords makes them easier to remember. But those shared rules are also a security weakness.

What I like about it

• No need to memorize individual passwords: Remember the transformations and build each password as needed.
• Different strings for each service: Shared components and transformation rules mean the passwords are not independent; one leaked password could help someone infer others.
• A complicated appearance: Unlike random strings, these passwords follow patterns. Looking complicated does not guarantee security.

Limitations I want to be honest about

There are limits to this method.

If someone learns the pattern—combining a phrase and a service name—and can guess the base phrase, they may be able to infer passwords for other services too.

Keeping the transformation rules private does not, by itself, make this secure. Someone could infer shared components or patterns from a leaked password. For especially important accounts, such as my main email and financial services, I don't rely only on this approach: I also use random strings managed with a password manager.

General security advice recommends long, random, unique passwords for every service, managed with a password manager—not just for especially important accounts. I can't recommend my transformation rules as a substitute. See CISA's guide to password managers for more detail.

Treat memorability and security as separate questions

Rather than memorizing complicated passwords individually, I keep a personal set of rules. That reduces the burden of managing them for me.

But easier management and security are separate things. If you've also forgotten passwords after making them complicated, consider using a password manager to keep independent passwords for each service.