An easy to remember password is built from real words you can visualize — like "coffee", "sunset", or "guitar" — then hardened with leet speak substitutions that swap letters for similar-looking numbers and symbols. The word coffee becomes c0ff33, and sunset becomes $un$3t.
The result looks complex to a password checker but stays memorable to you, because the original words still live in your mind. This approach is ideal for master passwords, device logins, and WiFi networks — anywhere you need to type a password from memory without a password manager.
Light leet replaces a→@, e→3, o→0, s→$. Heavy leet adds i→!, t→7, g→9, l→1, b→8. These substitutions are fixed, so they add no entropy — they exist to satisfy sites that demand a digit and a symbol. Strength comes from the number of random words.
ExampleMarble-Sunset-Kitchen-Pilot
Entropy~12.9 bits per word (7,776 pool)
MemorabilityGood — create a mental story
PredictabilityZero — crypto-random selection
Best forMaster passwords, high-security accounts
ExampleCoffee-Sunset-Guitar-Blue
EntropyLower — human-chosen words are predictable
MemorabilityExcellent — your own associations
PredictabilityHigher — personal words can be guessed
Best forWiFi passwords, low-risk logins, shared devices
Pick Vivid Words
Choose words that create a strong mental image — "volcano", "penguin", "neon". Concrete, visual words are far easier to recall than abstract ones like "concept" or "aspect".
Use 4+ Random Words
Four random words from a 7,776-word list give ~52 bits of entropy before leet speak. Each additional word multiplies the difficulty of cracking by 7,776×. Five words is the sweet spot for most accounts.
Add Personal Anchors
In custom mode, pick words tied to personal memories — your first pet, a favorite place, a childhood food. These are meaningful to you but unpredictable to others.
Light Leet Is Enough
Light leet (a→@, e→3, o→0, s→$) adds enough variety to pass most complexity checks without making your password unreadable. Heavy leet is rarely needed.
✓
4 random words = ~52 bitsFine for everyday logins
strong
✓
5 random words = ~65 bitsComparable to a 10-char random password
excellent
✓
Meets complexity rulesLeet speak adds digits and symbols automatically
compatible
✓
Crypto-random selectioncrypto.getRandomValues() for true randomness
secure
What is a memorable password?
A memorable password is built from real words — either randomly selected or chosen by you — then optionally transformed with leet speak substitutions (a→@, e→3, o→0, etc.). The result satisfies complexity requirements while remaining easy to recall because the underlying words form a mental image.
How secure is a memorable password vs a random one?
Strength comes from the words, not the leet speak. Four random words give ~52 bits and five give ~65 bits, whichever substitutions you apply. Five words is comparable to a 10-character fully random password. For maximum security use more words — adding characters to the same words does not help.
Does leet speak actually improve security?
No. Our substitutions are deterministic — every a becomes @, every e becomes 3 — so an attacker who applies the same rules lands on exactly the same guess. Cracking tools have applied these rules by default for decades. Leet speak adds zero entropy. What it does do is satisfy site rules demanding a number and a symbol, without making the password harder to remember. Add a word if you want more strength.
Should I use random words or my own words?
Random words are stronger because each word comes from a known pool of 7,776, giving ~12.9 bits per word. Custom words chosen by humans are more predictable, so we apply a 0.6× entropy penalty. Use random words for high-security accounts and custom words for low-risk logins where memorability matters most.
Can I use a memorable password as my master password?
Yes — a 5-word random memorable password (~65 bits) is a solid master password, and easy to recall without writing it down. Light leet speak is fine for meeting complexity rules but adds no strength. If you want a stronger vault password, add a sixth word (~78 bits) rather than more substitutions.
Is any of my data stored or transmitted?
No. All generation happens entirely in your browser using the Web Crypto API (crypto.getRandomValues). No words, passwords, or settings are ever sent to a server. Load the page, then disconnect from the internet — generation keeps working, because nothing you generate ever needs a server.