Strong Unique Passwords Without Predictable Suffixes

Updated 4 November 2026 · Standard formula, shown below

This guide shows you how to create strong, unique passwords for every account without relying on predictable suffixes like “!1” or “2024”. You’ll learn a simple method to generate memorable but random-looking passwords, and how to store them safely. No special tools are needed, just a pen and paper or a text file for practice.

What You’ll Need

A pen and paper (or a blank text file) to practice writing passwords.
A list of the accounts for which you need passwords (optional but helpful).
A password manager (recommended for storing the passwords you create).

Step-by-Step

Pick a base phrase or sentence. Choose something personal but not easily guessable, like a line from a favorite book or a made-up sentence. For example: “My cat loves to sleep on the warm windowsill.”
Take the first letter of each word. Using the example: Mcltsotww. This gives you a string of letters that is not a word.
Add a number or symbol that has meaning to you, but not your birthday or address. For instance, the number of siblings you have, or the year you graduated. Let’s say you have 3 siblings: add “3” somewhere in the middle, like Mcl3tsotww.
Mix in a special character that you associate with the site. For a banking site, you might use “$” or “â‚¬”. For a social media site, “@” or “#”. Insert it at a specific position, say after the 4th character: Mcl3$tsotww.
Make it unique per site. Instead of adding a predictable suffix like “facebook”, take the first and last letter of the site name and insert them into the password. For Facebook, that would be “F” and “k”. Insert them at a fixed position, e.g., at the beginning: FkMcl3$tsotww. For Gmail, it would be “G” and “l”: GlMcl3$tsotww.
Check the length and complexity. Aim for at least 12 characters. Your password now has 12 characters (FkMcl3$tsotww) with upper and lower case, a number, and a symbol. This is strong.
Test it in your memory. Say it out loud a few times. The base phrase is memorable, and the site-specific letters are easy to recall once you remember your rule.
Store it in a password manager. Even if you can remember it, a password manager keeps all your unique passwords organized and encrypted. You only need to remember the master password.

Common Mistakes

Using the same password everywhere. If one site is breached, all your accounts are at risk.
Adding predictable suffixes. Appending “!” or “1” to the end of a common password is easily guessed by attackers.
Using personal information. Birthdays, pet names, or addresses can be found online and are often the first guesses.
Making the base phrase too short. A 6-letter base phrase with a number and symbol is still weak. Use a longer sentence.
Writing passwords on sticky notes. Physical notes can be lost or seen by others.

Tips

Use a passphrase for the base. A sentence of 5-7 words is easier to remember than a random string of letters.
Be consistent with your rule. Always insert the site letters at the same position, and always use the same number and symbol. This makes it easier to recall.
Consider using a password manager’s generator. Most password managers can generate truly random passwords and store them for you. You only need to remember one master password.
Change your password if you suspect a breach. If a site you use announces a data breach, change that password immediately, even if it’s unique.
Enable two-factor authentication (2FA). This adds an extra layer of security beyond just the password.

Troubleshooting

I forgot the rule I used. If you can’t remember how you constructed a password, try to reconstruct it by thinking about the base phrase and the site-specific letters. If that fails, reset the password using the site’s “forgot password” feature and create a new one with a clearer rule.
The password is too long for a site. Some older sites have a maximum length (e.g., 12 characters). If your password is too long, you can shorten the base phrase or use a shorter site code (e.g., just the first letter of the site).
The site doesn’t allow special characters. In that case, omit the symbol and rely on the mix of upper/lower case and numbers. You can also add an extra number in its place.
I’m worried I’ll forget the base phrase. Write down a hint for the base phrase (not the phrase itself) in a secure place, like a note in your password manager. For example, “My cat’s favorite sleeping spot” as a hint for “My cat loves to sleep on the warm windowsill.”
I have too many accounts and can’t remember which rule goes with which. This is a sign you should use a password manager. It will store all your passwords, so you only need to remember the master password.

Frequently Asked Questions

Why can’t I just use a password manager and forget about this?

You absolutely can! This method is for those who want to be able to recall passwords without a manager, or as a backup if you’re locked out of your manager. A password manager is still the most secure option.

Is it safe to use the site name in the password?

Using a few letters from the site name is fine as long as it’s not a direct, predictable suffix like “facebook123”. Inserting letters at a random position based on your rule is much harder to guess.

How often should I change my passwords?

Only change a password when you suspect it’s been compromised, or if the site requires it. Frequent changes can lead to weaker passwords as people tend to make small variations.

What if a site gets breached and my password is leaked?

Because each password is unique, only that site is at risk. Change the password for that site immediately. You can check if your email has been involved in a breach using services like Have I Been Pwned.

Can I use this method for my bank account?

Yes, but for highly sensitive accounts, it’s better to use a completely random password generated and stored by a password manager. If you do use this method, make the base phrase longer and more obscure.

What makes a password “strong”?

Length is the most important factor. A 12-character password with a mix of upper and lower case, numbers, and symbols is generally considered strong. Avoid common words and patterns.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.