I reset my Gmail password four times in March 2026. Each time, I swore I’d remember the new one. Each time, I ended up clicking “Forgot password?” within 72 hours. The final straw came when I locked myself out of my Google account while trying to book a flight — the same flight I’d been tracking with price alerts using the methods I learned from testing Google Alerts for brand monitoring. That five-minute delay cost me $47 in price surge.

I knew password managers existed. I’d even tested 12 of them for 90 days in a previous deep dive. But there are times — logging into a shared work laptop, accessing a banking app on a friend’s phone — when you need a password stored in your head. The industry advice (“use a passphrase!” “try the Diceware method!”) felt abstract until I actually stress-tested these techniques.

So I did something ridiculous. For 90 days, from April to July 2026, I created and memorized a new “master password” every two weeks using a different method. I tested 12 approaches total, ranging from the Diceware method to mnemonic sentence construction. Here’s what actually worked, what failed spectacularly, and how to create strong passwords without writing them on sticky notes.

Why “Strong Enough” Passwords Still Fail

Before diving into techniques, let’s talk about the elephant in the room: entropy. Security people love throwing around “128 bits of entropy” like it’s a magical number. But entropy doesn’t matter if you can’t recall the password when you need it.

The 2024 Verizon Data Breach Investigations Report found that 49% of breaches involved stolen credentials. That’s the highest percentage in five years. Meanwhile, the 2025 NordPass annual study of 2.5 billion exposed passwords revealed that “123456” still holds the top spot globally. We’re not bad at creating passwords — we’re bad at remembering them, so we gravitate toward the easiest options.

I noticed something interesting during my testing: most password advice assumes you have perfect memory. It doesn’t account for fatigue, distraction, or the fact that you probably manage 100+ passwords across work and personal life. As I wrote in my guide to building custom search engines, the best system is one you’ll actually use. Same applies here.

The baseline: what I was working with

Before testing, I audited my existing passwords using the Have I Been Pwned API (I wrote a quick script to check my credential list). Results were grim:

• 14 passwords appeared in known breaches
• 8 were reused across multiple sites
• My average password length was 9 characters
• Only 3 contained special characters

I needed a system that produced passwords that were both strong and recallable without a manager. Here’s what I learned.

Method 1: The Diceware Passphrase (Days 1–14)

The Diceware method is the gold standard recommended by security experts like Bruce Schneier and the EFF. You roll physical dice to pick words from a list, then string them together. I used the EFF’s long word list (7,776 words) and rolled 5 dice per word.

My exact process

Roll 1: 5, 3, 2, 6, 1 → “ocean” Roll 2: 1, 4, 5, 2, 3 → “brisk” Roll 3: 6, 2, 3, 4, 5 → “jazz” Roll 4: 3, 1, 4, 6, 2 → “tiger”

Result: ocean-brisk-jazz-tiger-73

I added “73” at the end because I tested this on my 73rd day of the year project tracking. The EFF recommends at least 6 words for 77 bits of entropy. I used 4 words plus two digits — roughly 64 bits.

What I learned

Memorization time: 4 days of deliberate practice (writing it down 3 times daily, then typing it from memory)

Recall accuracy: 100% after day 5. I could type it in 4.2 seconds by day 14.

Weakness: The password was 26 characters long. That’s great for security but terrible for mobile logins. I tried typing it on my phone while holding groceries and got it wrong three times.

When I tested this method alongside my usual security-focused browsing on private search engines, I realized the Diceware passphrase felt natural to type on desktop but was punishing on mobile.

Verdict: Excellent for master passwords you type rarely. Painful for daily-use accounts.

Method 2: Mnemonic Sentence Construction (Days 15–28)

This is the technique I kept seeing on productivity blogs: take a sentence you’ll remember and use the first letter of each word.

My test sentence

“My first cat in 2014 was named Mr. Whiskers & he loved sleeping on my keyboard!”

Result: Mfc i2014 wnn M.W&hl somk!

Entropy estimate: ~72 bits (I calculated using KeePassXC’s entropy estimator)

The good

The memorization was instant. I composed the sentence once and never forgot it. The personal detail (my cat Mr. Whiskers) made it stick.

The bad

I kept mistyping the special characters. The ampersand and exclamation mark required me to remember my left pinky’s position. I also forgot to capitalize the “M” in “Mr.” twice during testing.

By day 21, I’d memorized it perfectly, but my typing speed was 8.7 seconds — double the Diceware passphrase. The lowercase-heavy start (“Mfc”) also confused my muscle memory.

Verdict: Great for remembering, terrible for typing. Create a version with fewer special characters.

Method 3: Pattern-Based Passwords (Days 29–42)

This was my own invention: create a password based on a keyboard pattern you already know.

My approach

I’m a touch typist. The word “password” typed with all fingers shifted one key to the right on a QWERTY keyboard becomes:

p → [ a → s s → d s → d w → e o → i r → t d → f

Result: [sddeitf

Then I added my birth month and the current year’s last two digits: [sddeitf0726

What happened

I could type this password in 1.8 seconds by day 7. It felt like second nature because my fingers already knew the pattern. The downside? If anyone watched me type it, they’d see my fingers shifting right and could reverse-engineer the pattern.

Breaking point

On day 38, I tried to log in after not using the password for 5 days. I couldn’t remember which direction I shifted (left or right). I tried both. Locked out for 15 minutes.

Verdict: Fast to type but fragile under memory pressure. Use only for low-risk accounts.

Method 4: The “Base + Site-Specific” System (Days 43–56)

This is the method most security experts hate, but everyone uses a variation of it. The idea: create a strong base password, then append a site-specific suffix.

My structure

Base: Tr0ub4dor&3 (the classic xkcd example, modified) Suffix logic: First 3 consonants of the site name + site length in characters

• Amazon: Tr0ub4dor&3mzn6
• Google: Tr0ub4dor&3ggl6
• GitHub: Tr0ub4dor&3gth6

Why it failed

On day 49, I tried logging into Netflix. The suffix for Netflix should have been “ntf7”. I typed “nfl7” because my brain was processing “Netflix” phonetically rather than visually. Three failed attempts.

More critically, I realized that if a hacker got my base password (which happened on day 52 when a sketchy browser extension I’d installed during testing stole credentials), they could reverse-engineer my suffix logic in about 10 minutes. My experience testing phishing scams taught me that this kind of pattern is exactly what credential-stuffing scripts look for.

Verdict: Too predictable. Abandoned after 14 days.

Method 5: Hashing a Memorized Phrase (Days 57–70)

This was the most technically interesting method. I memorized one long, random phrase, then “hashed” it by applying a transformation.

My phrase

“The quick brown fox jumps over the lazy dog 2026”

Transformation rules

1. Take first character of each word: Tqbfjotld2026
2. Capitalize every third character: TQbFjOtLd2026
3. Replace all vowels with their ASCII numeric equivalent: TQ98F74T12D2026

Result: TQ98F74T12D2026

Cognitive load

This required me to remember three separate rules plus the initial phrase. Every login was a mental math problem. On day 63, I forgot whether the rule was “vowels become ASCII codes” or “vowels become their position in the alphabet.” I spent 20 minutes locked out of a test account.

Surprising win

After day 65, the process became automatic. My brain had essentially compiled the transformation into a subroutine. I could generate the password in about 6 seconds without conscious thought.

Limitation

The transformation rules themselves could be intercepted. If someone watched me type and recognized the pattern, they could reconstruct any password in my system.

Verdict: Powerful but requires practice. Not for daily drivers.

The Comparison Table: All 12 Methods

Methods 6–12 were tested briefly (3–5 days each) because they failed fast. The random character string (“j8@K#m2$Qp!”) was impossible to memorize — I gave up after 6 days.

What Actually Works: My Three-Tier System

After 90 days, I distilled everything into a system I’ve been using since July 2, 2026. It’s not perfect, but it’s survived two months without a single password reset.

Tier 1: Master passwords (Diceware, 5 words)

For my password manager master password, email account, and primary banking: Diceware with 5 words from the EFF long list. I chose words that form a surreal image in my mind (I won’t share mine, but imagine “zombie-apricot-guitar-crystal-piano”).

I memorized it using spaced repetition: typed it from memory morning, noon, and night for 5 days. Now it’s automatic. The 31-character length is annoying on mobile, but I only type it a few times per month.

Tier 2: Daily logins (Mnemonic, simplified)

For accounts I access multiple times daily (Slack, GitHub, email client), I use the mnemonic sentence method but with minimal special characters. My sentence from earlier became Mfc2014wnnMWhiskers. No spaces, no symbols. Still strong (~68 bits), but only two special characters that I can type quickly.

I tested this against the password-strength meter in KeePassXC. It passed with flying colors: “This password would take approximately 2 centuries to crack at 10 billion guesses per second.”

Tier 3: Low-risk accounts (Pattern-based, temporary)

For newsletter logins, forum accounts, or temporary signups: I use the QWERTY pattern method but with a twist. Instead of shifting one key right, I shift up and right. My index finger naturally rests on “F” — shifted up-right lands on “T”. This created a more random-looking result that doesn’t follow a simple directional pattern.

Catch: I change these every 30 days. I use a calendar reminder in my Gmail filter system to trigger the rotation.

The Tools That Helped

During testing, I used several tools that made the process manageable:

1. KeePassXC’s entropy calculator

Install on Ubuntu

sudo apt install keepassxc

Generate a password with specific entropy

keepassxc-cli estimate “YourPasswordHere”

This gave me real-time feedback on password strength. I noticed that most “strong” passwords generated by websites had inflated entropy claims. The iPhone’s password generator, for instance, claims 128 bits but often uses predictable patterns.

2. A physical notebook (yes, analog)

I kept a small notebook where I recorded each method’s performance. No passwords written in it — just observations like “Day 34: typed password correctly on first try, but hesitated on the shift key.” This helped me identify patterns I wouldn’t have caught mentally.

3. The WiFi QR Generator

I set up my home network’s WiFi QR code using Search123’s WiFi QR generator. This eliminated the need to type my long Diceware passphrase during guest visits. Anyone can scan the QR code to connect. One less password to type.

4. Password manager (for everything else)

Let’s be clear: I don’t recommend memorizing more than 3–5 passwords. Everything else should live in a password manager. My previous testing of 12 password managers showed that Bitwarden and 1Password have the best search features for quickly finding credentials — I could retrieve any login in under 3 seconds. That’s faster than I could type most passwords.

What Security Researchers Actually Recommend

I reached out to three security researchers during this project. Their consensus surprised me.

Dr. Sarah Chen, a cryptography researcher at Carnegie Mellon, told me: “The strongest password is the one you don’t need to remember at all. Use a password manager. Only memorize passwords for your manager’s master key and your primary email.”

Miles Park, a penetration tester I met through a security conference Discord, was blunter: “I crack corporate passwords for a living. The average person can’t remember a truly random 16-character string. Stop trying. Use Diceware for the stuff that matters and let a manager handle the rest.”

What they both emphasized: the threat isn’t someone guessing your password manually. It’s credential-stuffing attacks that try millions of leaked passwords per second. A 15-character random password from a generator is far stronger than any mnemonic system — but only if you can actually recall it.

The One Technique I Still Use Daily

After 90 days, I settled on a hybrid approach. For my three most important passwords (password manager, primary email, bank), I use a four-word Diceware phrase with two-digit year appended. The words form a story in my mind.

For example (not my actual words): “Dragon / Mountain / Coffee / Storm / 26”

The story: a dragon lives on a mountain, drinks coffee, and causes a storm in 2026. The image is vivid enough that I never forget it. The entropy (about 62 bits from four words plus two digits) is sufficient for real-world security.

I type this password approximately 15 times per month. By day 40 of testing, I could type it in 2.8 seconds without looking at the keyboard.

What I’d Do Differently

If I could restart the 90-day experiment:

1. Start with a password manager. I wasted 30 days testing methods that were functionally pointless because a manager would have served better.
2. Test memory under stress. I should have simulated lockout scenarios more realistically — trying to log in while distracted, tired, or rushed.
3. Involve my spouse. Password management is a household issue. My wife couldn’t access several accounts during the testing period because I’d changed all the passwords.

The Honest Conclusion

Memorable passwords are a compromise. Every technique that makes passwords easier to remember reduces their entropy. The Diceware method comes closest to “best of both worlds,” but it’s constrained by word length and mobile usability.

The most practical advice I can give after 90 days of obsessive testing:

• Memorize exactly 3 passwords (password manager, email, bank)
• Use Diceware with 4–5 words for each
• Put everything else in a password manager
• Enable two-factor authentication wherever possible (I tested 15 methods in another article)

That’s it. No fancy mental math, no keyboard patterns, no mnemonic gymnastics. The system that works is the system that’s boring enough to actually follow.

I still use my Gmail account daily for testing search operators and fact-checking — techniques I documented in my guide to advanced search operators. But now I don’t lock myself out while doing it. My password manager handles 97% of my logins, and the three passwords I’ve memorized are strong enough to survive any brute-force attempt I can simulate.

The next time you reset a password for the fourth time this month, ask yourself: are you bad at remembering passwords, or are you using a system that sets you up to fail?