How to easily remember lots of different passwords?

Question

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard.

What system do you recommend that won’t compromise all my accounts when one site gets hacked (assume the worst case — site storing passwords in clear text)?

I am looking for a system that helps me remember the passwords, not a way to store them.

[The only secure password is the one you can’t remember](http://www.troyhunt.com/2011/03/only-secure-password-is-one-you-cant.html) — SilverlightFox, Jul 18 '14 at 21:22
**DO NOT**! Yes, you will need to remember one or two passwords to get into your computer, and then your password manager, but all the rest should be stored in your password manager, and so you don't have to try to remember them! — NH., Nov 14 '17 at 18:33

score 14 · Answer 1 · answered Oct 14 '12 at 16:21

14

To remember passwords, type them often. You can remember dozens of passwords if you type them daily -- that's muscle memory, the same kind which is used by martial arts practitioners, so remembering many passwords is like being a Kung fu master (albeit in a slightly less awesome way).

Bruce Schneier, well-known Chuck Norris imitator, recommends writing down your passwords and keeping them in your wallet. This makes sense because you are both trained and highly motivated at maintaining a high level of physical security on your wallet. I would double that with a copy of the same password sheet somewhere in your safe, so that you could recover from a wallet theft (i.e. logging again in all the sites and change your password). Also, a piece of paper has no battery which needs recharging.

(Caution: your smartphone is not a good wallet. Physical security on your phone is much lower than the one you apply on your wallet. Unless you are in the habit of flourishing your wallet at arm's length while walking in the street.)

answered Oct 14 '12 at 16:21

Thomas Pornin

320,799
57
780
949

I agree with Bruce and @ThomasPornin, write them down and keep them in a safe or in your wallet, I mean, how often do you lose your wallet? That being said, don't put your wallet on your desk and go to the can, keep it on you at all times. – GdD Oct 15 '12 at 09:22
+1 for muscle memory :) It is greatly useful for me when i solve Rubik's cube. – Ebenezar John Paul Dec 03 '13 at 09:49
I like the image of "flourishing your wallet at arm's length". Most notably iPhone bearers don't see it that clear :). – dan Jul 18 '14 at 18:08
2

The problem is that then the password list would become the most valuable thing in my wallet :/ – kinokijuf Jul 19 '14 at 09:32
It might be good to note that if passwords are written down in one's wallet, **not** to have an obviously identifiable way of noting *which accounts* each of those passwords are *associated* to. This is part of the problem that I have - I have plenty of strong, memorable passwords, but I have difficulty figuring out which password goes to which account, often resulting in account lockout. Perhaps there's a method to recall which password goes to which account...? – Sawta Feb 06 '17 at 14:46

score 3 · Answer 2 · answered Oct 14 '12 at 16:16

A way of resolving this issue I've been using with much joy lately is the PWDHash system by the Stanford Security lab.

Basically what is does is compute a cryptographic hash of your 'master password' together with the domain of the page you're signing up at, clips it and then fills the result in as the password. This way, every site you sign up for has a non-reversable password that does not compromise any other login, even if someone happened to stumble upon it in plaintext.

There are PWDHash addons for the major browsers, and you can use the web interface if you're on the move.

Other than the fact that it's a marvelous and easily understandable application of theory, a major upside is that you don't have to trust any third party with your passwords. Everything is done locally and open source - it works fine without an internet connection or incomprehensibly encrypted binaries.

Lucas Kauffman · Answer 3 · 2012-10-14T15:04:36.250

2

You can use a password vault. For instance you have a txt or an excel with all your passwords and you keep it in an encrypted container (truecrypt for instance) and just decrypt it when you need it.

However this is hard to actually use if you want it readily available at any time. If you trust other companies with your data, you could opt for sites like http://www.passpack.com to store your passwords. I'm not really a fan of this myself because you are never 100% how things are stored on the backend.

edited Oct 14 '12 at 15:04

answered Oct 14 '12 at 14:54

Lucas Kauffman

54,169
17
112
196

What if I’m not at home? – kinokijuf Oct 14 '12 at 14:55
pendrive, dropbox? – Lucas Kauffman Oct 14 '12 at 14:57
Connecting a pendrive to my phone would be really hard, and what’s a dropbox? – kinokijuf Oct 14 '12 at 14:58
added a section – Lucas Kauffman Oct 14 '12 at 15:04
I have updated my question. Sorry, I do not want to hand over my passwords to a third party. – kinokijuf Oct 14 '12 at 15:06
2

There are entirely offline password vaults designed for such use, like KeePass. – ewanm89 Oct 14 '12 at 15:06
2

Using KeePass 2 and store the encrypted database on dropbox is a common solution. – ewanm89 Oct 14 '12 at 15:08
@ewanm89 But they are inaccessible when I’m away from home. – kinokijuf Oct 14 '12 at 15:08
Dropbox isn't, can also use googledrive, skydrive... For that bit, or keep the database on a portable mass storage device. – ewanm89 Oct 14 '12 at 15:10
Indeed ewanm89 is correct, it is the best way. – Lucas Kauffman Oct 14 '12 at 15:37
1

I was asking a different question. I want a system that helps me __remember__ the passwords, not store them. – kinokijuf Oct 14 '12 at 16:15
You were all but clear about that. – Lucas Kauffman Oct 14 '12 at 16:21

score 2 · Answer 4 · answered Oct 15 '12 at 11:23

This can be done, but requires work, hence the popularity of password database software!

You'll want to study mnemonics, the art/science of systems of remembering things. Mnemonic performers do things like memorize the order of a shuffled deck of cards; those methods on a smaller scale should be enough to recall a few passwords.

Derren Brown's "Tricks of the Mind" has a good beginners tutorial, but here's an example of one simple technique, image linking, which should work well for pass phrases.

Suppose your email password is "correct horse battery staple". Imagine, in turn these silly images:

a huge pile of mail envelopes being corrected by a school teacher as if they were homework
the same teacher still correcting papers while riding a horse through the classroom
the same horse in a garage having it's battery changed by a mechanic in oily overalls
the same car batteries being used to power an enormous stapler

These are deliberately stupid images, the vivider the picture you can make in your mind, the better. Picture this sequence repeatedly, and you'll find that the sequence sticks in your memory; when you start your email program, you'll think of a mail envelope, which leads you to correct, to the horse, then to staple.

Bonus tips:

Choose words that are easy to visualise; you saw I had a little trouble with "correct" above!

If you don't like typing something that long, use a passphrase initialism, e.g. turn "abicjinh" into "apple bicycle idol chicken joker icicle notebook house" and make image links for those words.

You may have password complexity rules for some apps, where you have to use upper/lower case or numbers. These need a little more work.

Remember which letters are capitalised by picking some landmark from a capital city and setting the image there. e.g. for "aB" you visualise an apple riding a bicycle past the Eiffel tower.

Numbers are harder, the usual way is a "peg" system where you assign a reserved word to each number, memorise those, and then use the associated word in the image. e.g. memorise 1-gun, 2-zoo, 3-tree, then remember "a2" as a wild apple being exhibited in cage in the zoo.

Repeat 50 times and congratulations, you're now spending half of your free time learning passwords :) — Steve Dodier-Lazaro, Aug 21 '14 at 11:30
Er... question is explicitly about ways to remember multiple complex passwords... — Graham Hill, Aug 21 '14 at 13:53
I did not mean that your answer is off-topic, it's very much on-topic! I'm just thinking that it takes too much time to actually apply such a process, I don't find it sustainable for the majority of people. It would take me regular memory training and per-password training to switch to your answer so I would apply it only on a few passwords rather than the 50 or so I have to deal with right now. My rant was, still, exaggerated (but not meant to be offensive). — Steve Dodier-Lazaro, Aug 21 '14 at 14:02
Although I agree with @GrahamHill's suggestion in theory, in practice, if you need to do this for more than say, 15 separate login interfaces, the usability of the suggestion starts to break down. "Was it a carpenter that punched a duck, or a lama that kicked the wooden board? Something with a walrus...?" It's also not great for cases when the user is trying to figure out *which email address* a password is associated to. You could get around this by knowing that one password goes with a certain address, but this gets into the password reuse security concern. — Sawta, Feb 06 '17 at 14:26

score 1 · Answer 5 · answered Oct 14 '12 at 22:35

If it's something you really can't afford to lose, the safe mentioned above may be the best way. But if you want to truly remember them, you should try to make a sentence out of it.

When I have to create a new password, this is what I do:

I pick a song (if possible related to what I need the password for);
I keep the first letter of every word (I take as many words as needed);
I write these letters in 1337-speek (a modified version with only one character per letter: it's easier to type while singing (in your head of course!), and some letters are left).

Let's take an example: "Mary had a little lamb whose fleece was white as snow" → mhallwfwwas → m-411w=ww45 (the - is the horizontal bar of the H; same with = for F, * for P (from |*), …)

score 1 · Answer 6 · answered Oct 15 '12 at 16:43

1

I choose a few letters from the site name. Perhaps those letters are the acronym of the company name. I combine (prefix, append, embed) that with a sequence of characters (to make a strong password) that are the same for all of my passwords. For example:

google =              goog15#*xfg27%
yahoo =               yaho15#*xfg27%
Wall Street Journal = wall15#*xfg27%

answered Oct 15 '12 at 16:43

Les

443
3
9

It is better if the letters are transformed by an easy to memorise, but hard to guess if you just get to see one password. – kinokijuf Feb 22 '14 at 16:56
3

Once one password of this group is compromised, the computation function is clear, and the whole group is compromised. – dan Jul 18 '14 at 18:29
This is a really great suggestion, but I can think of an edge case where it would fail: I work for Example Company. I need access to: their public portal for exterior email, intranet site for internal traffic, an administrative interface, a lab version of all of the above. They are all owned/operated by the same company. Unless I base my password off some random bit of the URL (and not have a good reference for the admin panel), I would be reusing passwords. I face a similar real world use case for this, which is why I bring this problem up. – Sawta Feb 06 '17 at 14:34

score 0 · Answer 7 · answered Oct 16 '12 at 01:08

0

Use humor, rhyming, repetition, offensiveness, silliness, common patterns, embarrassing facts, and other similar techniques to remember your passwords.

Examples:

octagon@pentagon.gov
SquidSquisher
pork-the-roast
1ntouchwithmyself
dookie4donuts

answered Oct 16 '12 at 01:08

Mark Burnett

2,810
13
16

score 0 · Answer 8 · answered Jul 18 '14 at 17:35

I use a small USB device of my own making that allows me to carry around a strong password "boost" on my key chain. Every password I enter anywhere is at least 15 random characters.

For web sites I just tack on the first three characters of the web site domain at the end before I boost the seed to 15+ characters. Now, IF all web sites hash passwords then this approach is safe. The final password with the extra three characters on the end of the 15 character random password is still at least as strong as the 15 character password. The HASH, however, is completely different for each site (as long as the first 3 characters are different). So, since each of the site hashes are individually unbreakable by brute force attack, and each site has a completely different hash, the sites are isolated from cross site attack.

However, since not all sites today hash passwords, I also use PwdHash on the client to ensure that there is no way that a stolen clear text (or encrypted) password on a weak site will compromise all the other sites.

One way I try to to understand this is to envision a huge haystack and the need to hide a needle. If the needle is essentially impossible to find, then moving the needle a few inches away still makes it impossible to find.

So, if you can ensure that you enter a very strong 15+ character password with just a few characters different for each site, and ensure that the password is hashed by the site or locally on the client, you have as good a solution as carrying around a big password database. IMHO.

This is a good solution, but I do see three problems with it: 1) Theft of the USB. 2) You need to regularly backup the data on the USB elsewhere in case of failure. If it's on a keychain or similar for peace of mind, it'll probably get beaten up quickly, making ROF more likely. 2) Strict, security-minded organizations do not allow *any* form of external media on network, killing this idea. I realize OP didn't specify, but I know that I couldn't use this, I think a lot of others might be in the same boat. :( Outside websites are also no-go, exacerbating the need for wrote memorization. — Sawta, Feb 06 '17 at 14:40

score 0 · Answer 9 · answered Aug 21 '14 at 11:51

Password reuse is probably the best strategy for making you able to remember all your passwords without storage. Storing random and strong passwords still is probably a better thing to do, though -- just make sure you can access this storage if your primary device goes missing or stolen.

If you want to go down the path of password reuse, you can do it wisely to greatly minimise risks. What matters is that you identify the accounts that must not be compromised and give those a unique password. There are usually few of them: payment accounts, email accounts (password reset emails), and social-reputation-critical accounts (LinkedIn, maybe Facebook).

For the rest, reusing passwords across all websites of a similar theme greatly reduces your amount of credentials, especially if you need to register to a new site that you're not sure you'll ever reuse (e.g. ordering a plane ticket from a new airline). So long as connecting to a website does not allow monetary losses or identity abuses, that website is eligible for reuse.

See the questions and answers here:

score -1 · Answer 10 · answered Oct 15 '12 at 16:58

-1

Steve Gibson has a number of tools that may be effective - see password haystacks that has the effect of making the password far more memorable but more difficult to break. Alternatively Perfect Paper Passwords can make things easier to remember. There are also multiple variations of the technique recommended by @les

answered Oct 15 '12 at 16:58

MCW

2,572
1
15
26

2

Password haystack like most strength meters lulls users into thinking they're secure. No, 'Banana1' is not 11 000 times stronger than 'banana'! – Steve Dodier-Lazaro Aug 21 '14 at 11:40
@SteveDL It comes from Steve Gibson. What did you expect? :P – forest Dec 01 '18 at 03:32
Not sure we share the same understanding of password haystacking. Banana 10101010101 is much more secure than Banana1 – MCW Dec 01 '18 at 05:10
Mark, metrics that ignore the actual probability distribution of choices made by human beings are not reliable metrics. – Steve Dodier-Lazaro Dec 03 '18 at 14:57
At UCL we have developed (and never released, boo) a tool that captures user passwords and computes password strength metrics based on an individual user's past patterns of password choices. I'm aware some folks at CMU have developed similar tech accounting for indivdual patterns, and also a (proprietary, boo) password strength checker that accounts for global password choice patterns. – Steve Dodier-Lazaro Dec 03 '18 at 14:58

score -1 · Answer 11 · answered Oct 15 '12 at 17:07

Put a business card in your wallet with a matrix of shapes, digits and punctuations marks on it. Then just memorize small shapes and use the corresponding icons as your password.

If you prefer to memorize them use the palate method, remember 10 sets of numbers and words, use 3 to make a password and you're instantly got 1000 unique passwords.

How to easily remember lots of different passwords?

11 Answers11

Linked

Related