How to Create Strong Passwords You Can Actually Remember (The FBI-Approved Formula)

According to Verizon’s 2023 Data Breach Investigations Report, 81% of hacking-related breaches involve stolen or weak passwords. That’s not a stat to shrug at—it means the odds are stacked against you if you’re still using Password1! or your dog’s name with a number at the end.

I’ve spent years helping friends and colleagues fix their password habits. The advice you usually hear—“use 12+ characters, upper/lowercase, symbols, numbers, and make every password unique” is technically correct, but it’s humanly impossible without a system.

People end up writing passwords on sticky notes, reusing the same one across sites, or using simple patterns that hackers can see in seconds.

The trick isn’t to memorize random strings. It’s to build a formula that’s personal to you, easy to remember, and produces different passwords for every site. The method I’m about to show you comes from actual FBI cybersecurity training. I’ve adapted it slightly to handle real-world quirks, but the core is the same.

Why Most Password Advice Fails?

I once had a client who prided himself on using “strong” passwords. He’d generate random ones from an online tool, write them in a notebook, and store that notebook in his desk drawer. When his company got breached, the notebook meant nothing—the hacker had phished his work email and already had access to everything.

The problem is that security advice rarely accounts for human behavior. Telling someone to “use a long, random password” is like saying “win the lottery”—it’s not a strategy. People either:

• Reuse one decent password everywhere (catastrophic if any site leaks it)
• Write them down (loses the security advantage)
• Forget them constantly (wastes time and frustration)

The formula approach solves all three. You only need to remember the recipe, not the individual passwords.

The Core Problem: Memory vs. Security

A strong password has two properties:

1. High entropy – lots of possible combinations, so brute-force attacks can’t crack it quickly.
2. Uniqueness – never repeated across services.

The standard recommendation is 12+ characters mixing uppercase, lowercase, numbers, and symbols. But try remembering Xk4!mN9#qR2$ for each of your 50+ accounts. It’s not going to happen.

The formula method works because your brain is great at remembering patterns, not random strings. Once you internalize the pattern, you can reconstruct any site’s password in seconds without writing anything down.

The Smart Formula: Your Personal Password Recipe

Here’s the structure, which I’ll explain in plain language. You’ll need to pick your own values—don’t copy mine.

Part 1: The Base (Fixed for every password)
Choose something memorable but not guessable. An airport code (like MSP for Minneapolis), a band abbreviation (ZEP for Led Zeppelin), or a color pattern (Blu for blue). Mix uppercase and lowercase: I use it mP for Minneapolis, then replace the last letter with a symbol $ → mP$.

Part 2: The Site Identifier (Changes per site)
Pick two letters from the website’s domain name. I use the second and third letters. For BestBuy.com, that’s e and s. Write them in uppercase: ES.

Part 3: The Constant Symbol (Always the same)
Pick one symbol you’ll always add at the end (or beginning). I use !.

Part 4: The Constant Number (Always the same)
Pick a number that isn’t your birthday, address, or phone. I use 42 (the Answer to Life, the Universe, and Everything).

Put it all together: mP$ES!42

That’s 8 characters with mixed case, a symbol, and a number. For Gmail, I’d use mP$AM!42 (second and third letters of “gmail” are a and m). Totally different, yet I don’t need to memorize either.

Step-by-Step Examples (Real Sites)

Let’s build a few passwords using the same formula. Base: mP$ (airport code), site letters: second and third from the domain, symbol: !, number: 42.

Website	Domain	2nd & 3rd letters	Password
Amazon	amazon.com	m, a	mP$MA!42
Facebook	facebook.com	a, c	mP$AC!42
Dropbox	dropbox.com	r, o	mP$RO!42

Notice each password is different, but they all follow the same pattern. To recall your Facebook password, you mentally run the recipe: base + site letters + symbol + number. That’s it.

One thing worth checking: some sites are case-sensitive. The formula works as long as you’re consistent. I always put the base and site letters exactly as I decide (lowercase for first, uppercase for second in base, uppercase for site letters). Don’t second-guess yourself.

Anecdote: Last year, a friend tried this method after getting his Facebook account hacked. He had used it password123 everywhere. Within a week, he had unique formulas for 15 sites. He told me, “I actually look forward to entering my password now because I feel smart.” That’s the goal—make security feel empowering, not punishing.

Handling Tricky Site Rules (Symbols, Length Limits)

Here’s where the formula hits a wall. Some websites reject certain symbols, or force a maximum length shorter than your password, or require at least one uppercase letter exactly at a specific position.

Common issues I’ve seen:

• The site doesn’t allow $ or ! in the password.
• The site requires exactly 8 characters, and your formula outputs 9.
• Site forces you to include a number, but your number is too long.

The fix is simple: create backup rules. If a symbol is rejected, replace it with an exclamation point. If your base is too long, drop the last character. If the site demands a capital letter somewhere, add one at the beginning (like adding A before everything).

Example: Your formula gives mP$MA!42 (9 chars). The site allows only 8. You can drop the ” and ” 42 and use mP$MA!. Or drop the base symbol. Decide ahead of time which part you’ll sacrifice. I personally shortened the number part because it’s the least critical to entropy.

Anecdote: A reader emailed me saying a banking site required a special character only from a predefined list (like ^, *, _). He had used it ! as his constant. I told him to replace it with * for that site only—and write an alias in his password manager note. It’s fine to deviate from the formula as long as you document the exception.

When to Change Your Passwords (And When Not To)?

Old advice said, “Change your password every 90 days.” Modern cybersecurity experts (including the FBI) now say: don’t change passwords arbitrarily—only change when there’s a reason.

Reasons to change:

• The site you use reports a data breach (check haveibeenpwned.com)
• You clicked a phishing link or suspect your device is compromised
• You shared your password with someone and regret it

Changing on a schedule doesn’t help because hackers don’t wait for calendar dates. It just encourages people to make predictable variations (Password1! → Password2!).

With your formula, changing a breached password is easy: just modify one component. For example, change your constant number from 42 to 99. Every site password changes instantly across all accounts. Or change the base symbol. You don’t need to update every site—just the ones whose password you believe was leaked.

Password Managers vs. Browser Autofill: The Real Trade-off

The video warns against saving passwords in web browsers. I strongly agree. If someone accesses your computer, they can view all saved passwords in Chrome or Firefox settings without needing your master password (only your system password). That’s a single point of failure.

A dedicated password manager (like Bitwarden, 1Password, or KeePass) offers:

• Encrypted vault with a strong master password
• Autofill without exposing passwords to local browser storage
• Cross-device sync
• Security audits and breach alerts

But there’s a catch: you still need a master password that you can remember. That’s where the formula method shines—use it to create your master password. Then let the manager generate random passwords for the rest. Best of both worlds.

I generally don’t recommend browser autofill unless you’re the only user of that computer and you practice excellent physical security (locked screen, encrypted drive). But for most people, a password manager is safer.

Frequently Asked Questions

What if I forget the order of my formula?

Write down the recipe in a safe place—not the actual passwords. For example, on a piece of paper in your wallet: “Base: airport code MSP, replace third letter with $, site letters: 2nd and 3rd of domain in caps, symbol #, number 73.” Even if someone finds the paper, they can’t use it without knowing which site you’re logging into.

Can I use the same formula if two sites have identical second and third letters?

Yes, it’s fine. The password will be identical for those two sites. But you can avoid it by using a different pair of letters (e.g., first and third instead). Or just accept the tiny collision—it’s still far better than using password123 everywhere.

Does the formula work for sites that require a password change every 90 days?

You have options: change the constant number, or swap the symbol for a different one, or flip the case order of the base. I recommend keeping a note (in your password manager) of which “version” you’re on. The formula stays the same; just the variable shifts.

Is 8 characters really enough?

Eight characters is the minimum. The formula produces 8 characters by default. If the site allows longer, you can pad your base with extra characters (e.g., MSPMSP$). The most important thing is uniqueness and not using dictionary words. Even 8 characters with mixed case, symbols, and numbers are very resistant to brute force for most accounts. For sensitive accounts (email, banking), I add 2–3 extra characters to the base.