Nobody picks a password randomly. You pick something you can remember, which means you pick something that means something, which means somewhere out there on a forgotten account for a website that probably doesn’t exist anymore is a password that is a pet’s name, or a place, or a year that mattered, or the name of a person you were very focused on at a particular time in your life. You encrypted yourself into the infrastructure of the internet and then forgot about it and moved on and the password is still there, sitting in some database, holding a version of you that no longer applies.
I had a phase of using a song lyric that was important to me at twenty-two. Then a nickname only certain people used. Then a place I went once that stayed with me. Each era had its own password logic, its own set of things that felt memorable enough to anchor to. If you could reconstruct someone’s password history you’d have something close to a map of their inner life — what they were protecting, what they couldn’t forget, what they were still carrying.
The security people are right that you shouldn’t do any of this. Random strings, password managers, nothing meaningful, nothing guessable. And they’re correct from a security standpoint but what they’re describing is the complete removal of yourself from the act of remembering. A password manager means you never have to choose something that means something. Which is safer and also a little sterile, a little like being told to stop writing in the margins of books because it degrades the resale value.
The weirdest moment is when you get locked out of an old account and have to guess your way back in. You’re essentially trying to think like a past version of yourself — what would I have used in 2014, what was I into, what name was I not over yet, what would have felt clever to me at that age. Sometimes you get it right and it’s like finding a door in a wall you forgot was there. Sometimes you don’t and that account is just gone, sealed off, belonging to someone who no longer has the key.
I got into an old email account last year that I hadn’t opened since 2012. The password was a name. I’m not going to say whose. The inbox was a full reconstruction of a year I’d half-remembered wrong. I read for about forty minutes and then closed it and haven’t gone back. Some archives are better left password protected.