Tech Matters: How to create strong passwords like Apple
Passwords are both the bane and the backbone of your online life. Facial recognition and fingerprint scanners have brought us closer to a passwordless future, but we’re not there yet. Most websites still rely on passwords to protect your accounts, and you’ve probably faced that sinking moment when you need a password you can’t remember. Wouldn’t it be great to create passwords that are both secure and easy to manage?
Apple has developed a clever approach to passwords for its devices, but you don’t need a Mac, iPhone, or iPad to benefit. You can borrow Apple’s strategy to make your own passwords stronger, safer and more user-friendly.
Passwords as we know them began appearing in the 1960s, when MIT introduced them for its Compatible Time-Sharing System (CTSS), which allowed multiple users to log into the same computer. At that time, passwords were short and simple–a few characters at most–and served the purpose of separating users, not guarding against hackers. By the 1980s and 1990s, as personal computers and the internet became mainstream, passwords were widely adopted for accessing email, online services and early e-commerce sites.
Back then, typical passwords were easy to guess. Many people used “password,” “123456,” or “qwerty” because they were simple to remember and quick to type. Some users added a personal touch, like their name, birth year, or phrases like “Iloveyou” or “letmein.” Hackers quickly caught on, and brute-force attacks–using algorithms to guess common combinations–made these passwords unsafe.
As online security threats grew, so did advice on creating strong passwords. By the early 2000s, users were encouraged to create passwords with a mix of uppercase and lowercase letters, numbers and symbols. Passwords like “Pa$$w0rd!” became the gold standard, but they often lacked the length needed to deter modern hacking techniques. Today, the emphasis is on creating longer passwords–16 characters or more–with random combinations that don’t follow predictable patterns.
Apple’s system for autogenerated passwords, introduced in 2018, follows these best practices. Ricky Mondello, the security expert at Apple behind the system, explained in a recent blog post about his original password presentation, “So these new passwords are 20 characters long. They contain the standard stuff, an uppercase character. They’re dominated by lowercase. We chose a symbol to use, which is hyphen. We put two of them in there, and a single [digit]. We picked this length and the mix of characters to be compatible with a good mix of existing websites.”
Apple’s passwords are carefully designed to balance security and usability. First, they’re divided into three sections with hyphens, which makes them easier to read and type. This is especially helpful when entering passwords on less conventional devices, like gaming controllers or smart TVs.
Second, Apple generates two-syllable nonsense words using a consonant-vowel-consonant pattern, creating “pseudo-words” that you can hear in your head. For example, a segment like “funrus-Hommez-kajzo7” might not mean anything, but it’s easier to remember briefly than a string of unpronounceable letters.
“These aren’t real syllables as defined by any language. We have a certain number of characters we consider to be consonants, which is 19. Another set we consider to be vowels, which is six. And we pick them at random,” Mondello said.
The placement of numbers and uppercase letters is also intentional. Apple includes only one uppercase letter to keep typing simple–particularly on devices that make switching between cases cumbersome. Similarly, the number is placed near a hyphen or at the end to avoid disrupting the pseudo-words, making the password easier to manage.
Apple’s system also filters out offensive or inappropriate substrings using an on-device dictionary. “We actually have a dictionary of offensive terms on device that we filter these generated passwords against,” Mondello said.
Even if you’re not using an Apple device, you can adapt these principles to create your own strong and practical passwords.
Start by aiming for length. A password of at least 20 characters is significantly harder to crack. To make it manageable, break it into smaller chunks, separating them with hyphens or other special character.
Structure your password like Apple does, using nonsense words made up of consonant-vowel-consonant patterns. Avoid real words or phrases, which are easier to guess. Adding a single uppercase letter and one number increases security, but placing them carefully–near a special character or at the end–keeps the password easier to type and remember.
Lastly, steer clear of predictable patterns like repeating numbers or phrases. If you’re worried about accidentally creating something inappropriate, take a moment to review the password before using it.
As Mondello sums up, Apple’s system is designed to balance practical usability with strong security principles. By following these ideas, you can create passwords that protect your accounts while being easier to manage.