How to create—and remember—a different password for every single login
Here is a neat trick for how you can create and remember thousands of good, secure and UNIQUE passwords, using keys. No more identical passwords, and no more easily breakable ones either. Spend 5 minutes reading this blog post, you won’t regret it. Money back guarantee!
The problems
If you take security seriously, you’d want to avoid for instance simple, short passwords and passwords that can be found in a dictionary. If someone gets hold of a user database with your username and hashed password in it, it’s just a matter of time before it can be cracked. And if you use the same passwords on all your logins all over the internet, you’ll be in real trouble.
The challenge
- Use both small letters, capital letters, numbers and symbols, and combine this into a password with minimum 12 characters.
- Remember what you came up with in #1.
- Repeat process for hundreds of logins with equally complex passwords, and still remember them all.
The solution
Here is how…
1. Create a memorable password
Use some things you can relate to, stuff you remember, like a favourite movie quote, the first book you read, the number of dollars you stole from your mother that time, the opening lyrics to a song you once wrote, the first letters of the words of an opening sentence in a book. Anything goes!
I’ll take a piece of a quote from “The Long Kiss Goodnight“:
Alice, please. Your dog!
Note how I managed to get both a comma, a period and an exclamation mark in there.
Now, I take away the spaces, because spaces cause issues with lots of databases it seems, so I end up with:
Alice,please.YourDog!
2. Make the password more secure
“More secure” does in this case mean: Less dictionary words, more length and/or more complexity. For instance I have not used any numbers yet. So I’ll convert the A to a 4, because they look similar. It’s also a bit long, so to shorten it (and give my blog a bit more hacker-like credibility!) I’ll change “please” to “plz”, “Your” to “Ur” and “Dog” to “Dwg”, which is short for “Dawg”. (of course!) I end up with this:
4lice,plz.UrDwg!
Swapping A for 4 is a bit obvious perhaps and it feels like it needs more numbers. So since we’re talking about dogs, I’ll also add the age my first dog was when he died:
4lice,plz.UrDwg!12
That’s actually 18 characters long, so I’ll stop there before I scare you readers off. I’d recommend a phrase of at least 12 characters though.
Work the phrase like this, adding or substituting stuff, until you have something that looks like nonsense, but makes perfect sense to yourself. Don’t worry if it takes a long time to type. You’ll be typing it a lot in the time to come, so soon you’ll hammer it down in milliseconds.
3. Memorize it
Yes, you have to memorise it, sorry. It’s hopefully a hard one, but step #2 should however make it easer for you.
Oh, and keep it secret too!
4. Add keyholes
Here comes the part that makes it interesting. We are going to make parts of our password variable, by adding two keyholes. You can use one or five too, that’s up to you. A keyhole is an opening where we will insert keys. The keys are what will make our passwords unique.
Here, I’ve inserted two underscores to represent my keyholes:
4lice,plz._UrDwg!12_
These two keyholes will change according to where we are logging in. Keep reading, you’re almost there!
5. Add keys
Keys are what goes into the keyholes, and we want to vary these as much as possible. They need to be different, but predictable, so we determine these by rules.
Here are some examples of rules you can use to create keys for two keyholes:
- The first + second letter of the domain name of the website you’re logging into.
- The first letter of the first syllable of the sitename you are accessing + the capitalised first letter of the second syllable.
- The number of letters in the domain name + the first vowel in the sitename.
- The two last letters of the domain name + the two first letters of the sitename.
- etc…
Spend some time on this part to make one fun and unique rule for yourself. Keep this secret.
Rule #1 here was the first rule I tried when experimenting with this way of making passwords, and it is not very good. The reason is that I log in at many websites that have domain names that begin with the word “joomla”, thus my keys became “j” and “o” very often.
So base your rule on something that’s mostly static for each website, but not similar to many websites.
6. Start creating passwords
Let’s say I was going to use rule #4 with my password from above. My password, with two keyholes, was this:
4lice,plz._UrDwg!12_
If I was logging into digg.com, which has the sitename Digg. Using rule #4 then the two keys would be “gg” and “Di”, where “gg” are the two last letters of the domain name, and “Di” are the two first letters of the sitename. When I insert these two keys into my keyholes, I get this password for logging into digg.com (keys are underlined):
4lice,plz.ggUrDwg!12Di
Here are some passwords for some other sites:
joomla.org: 4lice,plz.laUrDwg!12Jo
wordpress.com: 4lice,plz.ssUrDwg!12Wo
drupal.org: 4lice,plz.alUrDwg!12dr
twitter.com: 4lice,plz.erUrDwg!12Tw
facebook.com: 4lice,plz.okUrDwg!12Fa
So I end up with 22 character long passwords, and most of them will be unique, and some will be the same, depending on the rules and keys you use.
Most important of all though: They will be complex, but I will still remember every single one of them.
7. Ideas to complicate things even more
For those of you who really want to be totally paranoid about it:
- Use variable keyholes too. If the sitename starts with a vowel, add a keyhole to the front of the password. If not, add a keyhole to the end.
- Base key rules on stuff that changes now and then. For instance a website’s main colour, or the number of main menu items it has. This will occasionally break your password, and you’ll have to use the “forgot password” function to reset it and change now and then, which can be a healthy thing to do.
- Have different usernames too, but perhaps not too obvious, since these often are visible to others. “torkilDIGG” is not a too good digg.com password. When people also see my Joomla forum username being “torkilJoomla”, then they’ll know the pattern straight away. Numbers could be good though, like torkil4 for digg.com and torkil6 for joomla.org, since digg has four letters and joomla has six. It gives you some variation at least.
- Keep a list of random keys. Yes, a list. Write them down. Your list could look like this:
Digg: x76T
Facebook: pOw2
Stumbleupon: 99!bOnly you would know what to do with these four characters. And then store this file in an encrypted format on a computer not connected to the internet, buried six feet under your house. ;)
Got any ideas on how to make a memorable but complex and unique password? An idea on how to obfuscate common words? Perhaps a genius rule for creating keys? A way to make things more complex? Share below!
Pingback: Torkil Johnsen » Collection of Joomla Security Tips