Password Practice
Practice making and remembering strong passwords — in a safe sandbox. Your real passwords never go here.
Nothing here is saved. Nothing is sent anywhere.
Step 1. Pick a memorable base phrase
Think of a short sentence only you would say — a line from a song, a story about your dog, a favorite meal from a trip. Example: My beagle Sam ate 3 tacos in 2019!
Step 2. Shorten to a code
Take the first letter of every word. Keep any numbers and symbols as-is. Add something personal that only you know — a number of steps your dog takes, the year you got married, a favorite emoji-like symbol.
Your short code will appear hereStep 3. Make a per-site variation
Never reuse the same password on two sites. A small tweak per site — the first three letters of the site name — means one leak won't expose every account. A password manager does this automatically with random values; this is the manual fallback.
Per-site variation will appear hereRed flags
Green flags
Passphrase generator
Tap the button for a random multi-word passphrase. Long and memorable beats short and cryptic every time. Practice only — don't reuse a phrase you generate here for a real account.
Is it on a common-passwords list?
Type a practice password to see if it matches our 100-entry sample of the most-reused passwords. Real managers like Bitwarden integrate with "Have I Been Pwned," which checks your password against hundreds of millions of real leaks without ever sending it over the internet.
Two-factor authentication (2FA) — a second lock
Even a perfect password can leak. 2FA asks for something else — a code, a tap, a physical key — so a stolen password alone is not enough to log in.
What to do if you get a breach email
Sticky-note reality check
Writing passwords down is fine — a password manager is better, but a notebook beats reusing "sunshine123" on every site. If you do write them down:
Frequently asked
Yes, for practice values you make up or that are generated on this page. Nothing is sent to a server, and nothing is stored other than your streak counter. Still — don't type your real, active passwords into any website that isn't the actual login page.
For almost everyone, yes. Even a free one like Bitwarden or Apple Passwords is a major upgrade over writing passwords in a notebook or reusing the same one. The one master password you still have to remember — that's the one worth drilling here.
Several unrelated words strung together, sometimes with a number or symbol. Example:Lantern-Copper-Otter-Glacier-17!Longer than most "complex" short passwords, and far easier to remember.
Passkeys are a newer replacement for passwords entirely. Your device proves who you are with a fingerprint or face, and there's no password to steal or phish. More and more sites support them — turn them on when the option appears. They work alongside your existing password, not instead of it.
A printed emergency sheet kept in a safe or locked drawer is a reasonable backup — especially for your master password and recovery codes. Shred old copies. Never leave it in a car, laptop bag, or desk at work.