The Password Story

The trouble with a good password is that the qualities making it good — long, strange, unpredictable — are exactly the qualities that make it impossible to remember. So people cheat. They shorten it, or reuse it, or write it on the underside of something, and the strength they bought is handed straight back. I've watched serious people protect serious things with a password they picked because it was easy to type. That's not security. That's a hope.

There's an old memory method that fixes this, and the trade trained it into me long before anyone called it a life hack. You don't memorize a string. You memorize a scene.

Why a scene beats a string

Your memory is genuinely bad at random characters. Always has been. But it is remarkably good at images — odd, vivid, slightly wrong little pictures. A face. A movement. A place. An out-of-place detail. String those together into a tiny story and your mind holds it without effort, because that's the kind of thing minds are built to hold.

A story also gives you length for free, and length is what actually beats the machines that guess passwords by brute force. A short clever password falls. A long ordinary one holds. The story hands you length you can carry around in your head.

And a scene survives stress. The moment you most need to recall a password is usually the moment your nerves are worst — and under nerves, a clean little image comes back when a jumble of symbols won't.

Building one

You assemble the scene from parts that don't belong together. The wrongness is the glue. Roughly: a person, an action, an object, a place, and a couple of details that make it specific — a number, a symbol.

Picture something like: a grey courier drops four coins at gate nine, in the rain. It's vivid, it's slightly absurd, and you can see it instantly — the grey coat, the coins scattering, the number on the gate, the wet. Nobody else has any reason to picture that, which is the whole point.

Then you harden the scene into the actual password by pulling its pieces together and roughing them up: capital letters where the scene has them, the number kept as a number, a symbol on the end. GreyCourierDrops4CoinsGate9Rain!

That is a long password. It's also one you could reconstruct from the picture alone, weeks later, with no note anywhere. (And no — don't use that one. It's just to show the shape. Build your own scene, one nobody could guess from knowing you.)

The rules around it

The method is sound. People still ruin it, so a few hard lines:

• A different story for every account that matters. Reuse is the cardinal sin. One breach somewhere should never unlock anything else.
• Build your strongest scene for your email. It's the master key — it resets everything else. Treat it accordingly.
• Aim long. Sixteen characters and up. The scene makes that painless.
• Keep them somewhere trustworthy. No one has the head-space for a hundred stories. The few that matter most, you keep in your head; the rest belong in a proper password manager. Memory for the crown jewels, the vault for the everyday.
• Turn on the second factor wherever it's offered. A known password should still not be enough on its own.
• Move fast when something's breached. A scene is cheap to rebuild. Change it the moment a site you use is compromised.

And what to avoid, which is the same list it's always been: pet names, birthdays, anniversaries, the street you live on, single dictionary words, the obvious little sequences. Anything that could be lifted from knowing you, or guessed by a machine working through the common ones. The strength is in the strangeness. A scene only you would ever picture, vivid enough to keep, peculiar enough that no one else arrives at it.

Details changed, the example deliberately useless. The method I'd stake something on.

The safest place to keep a password is the one place no one can reach: a strange little scene only you can see.

— M.