Most password hints fail in one of two ways: they say nothing ("the password") or they say everything (the password itself). The password hint examples below show the middle path — prompts that point at a memory without exposing it — organized by the categories our generator uses.
Example patterns by category
| Category | Strong pattern | Why it works |
|---|---|---|
| Childhood | The teacher who taught me ___ was named ___. | Specific, dated, hard to research |
| Places | I got lost in ___ near ___. | A story, not a fact — stories resist guessing |
| People (fictional) | The villain in ___ wanted ___. | Taste-based; no public record |
| Media | The show I binged in one weekend was ___. | Private habit, not public profile |
| Inside jokes | The phrase ___ means ___ to us. | Unintelligible without the in-group |
| Mnemonic | Take the first letters of: ___. | Describes a method, reveals nothing |
Notice the shared trait: every strong pattern contains blanks. The written hint is a question; only your memory holds the answer. That is the whole technique.
Good hints vs bad hints
| Bad hint | Why it fails | Better version |
|---|---|---|
My dog Sunny | Pet names are guessable and often public | The vet visit that cost ___ taught me ___. |
Birthday 1990 | Dates are brute-forceable | The year everything changed was ___ because ___. |
You know it | Helps nobody, not even future-you | The joke about ___ that only ___ understands. |
Password123! | That is the password — catastrophic | Delete it. Use a prompt with blanks instead. |
Mother's maiden name | Public record in many places | The recipe ___ never wrote down was for ___. |
Lessons from real breaches
Security researcher Troy Hunt's analysis of the Adobe breach showed how badly hints fail in practice: large numbers of users had essentially used their password as their hint, or chosen hints ("favorite color", "dog's name") that narrowed the password to a tiny guessable space. Attackers who stole the hint database could guess vast numbers of passwords without touching the password hashes at all. The lesson is blunt: a hint database is a password-guessing aid for attackers. Write every hint accordingly.
Three rules for writing your own
- Never include the password — not the whole thing, not a part of it, not a "clever" transformation of it. If reading the hint gets someone measurably closer to the password, rewrite it.
- Prefer stories over facts. "I got lost in ___ near ___" beats "favorite city" because stories have private details that facts lack.
- Test it on a stranger. Read your hint to a friend. If they can guess the shape of your password from it, it is too revealing. If even you cannot reconstruct the password from it a week later, it is too vague.
A worked example
Suppose your password scheme is "a movie quote plus a number". A bad hint would be movie quote 1994 — it describes the scheme. A good hint is a prompt with blanks: The movie I can quote from ___ is ___. Reading it, a stranger learns nothing; you instantly think of the film, the line, and the number you attached to it. The hint carries the pointer, your memory carries the payload. That separation is the entire security model of a good hint — keep the two apart and the hint can be as public as a billboard.
Try it: open the HintHarbor generator, pick the category closest to your strongest memories, and generate six prompts. Keep the one that makes you smile with recognition — that emotional jolt is the memory hook doing its job.
Related guides
- What are password hints — where hints appear and their hard limits.
- Password hint security tips — the full safety playbook.