I just swapped my old password at work and every time I sit down at the computer, I end up typing the old one because it is an ingrained habit. How can I get myself to type the new one instead? To be clear, this isn't about remembering the new password, but about remembering to use the new password.
Remembering a Password
A password you can't remember is a bad password though. Read more below in Creating a Good Password Scheme.
But anyways, if you don't have a choice, then the most important advice I have is: type it over and over again!!
You need to make it become your brain associates with multiple environmental elements: associate it with a typing rythm, recognize how it "sings" to you as you type, associate characters with their pronunciation in their heads (remember to not whisper them to yourself thoug...), etc... This will help you memorize it, but will also add elements that drive your muscle memory home.
One thing I'd recommend would be to switch your computer's auto-lock rules for the next few days to be very strict and lock very quickly: you'll be forced to type in the password so often that you'll get used to it very quickly.
Remembering to Use a New Password
*The computer will remind you of that, don't worry... :)
But if you want to avoid the nagging (and the frustration of the "oh right, dammit, did it again!"), maybe just write "NEW PASSWORD" in on a BIG note stickied on your screen, desk, keyboard, mouse... Something that's in your face, and that you're bound to see when you sit back at your desk.
Even your OS allows it, may have it display it as a message on the login screen?
I have to say I never really had this problem for more than a day though. The weird thing is that sometimes, a long time later, I'd suddenly catch myself trying to use a very old password for no reason. But the repeated use of the previous password goes away in just a day or 2 usually, if it's used for most systems (computer, mail, source control...).
Creating a Good Password Scheme
All my passwords follow these requirements:
Yet I never forgot any of them, and they have a decent password strength.
What's the Catch?
Use a base password with your own transformation rules to be able to generate a password based on the environment or context in which it is used.
Say, create a strong base from something you can easily remember. For instance, let's say you're an old video game fan. You could start from the classic quote:
Right. Easy. Now let's switch that to:
That's actually already a decent password for most purposes, though anyone watching you type it a few times would be able to figure it out relatively quickly. And it's not unique for each system.
So now, let's say you want to register for a StackExchange account and you need to create a password.
This could become your new password:
I just added a simple prefix to my password, thus rendering it:
Of course, that's just an example and a very simple transformation. But that's already decent and more secure than using "HelloKitty87".
Yes, but... Downsides?
What if Someone "Cracks the Code"?
Of course, that means there's a reproducible scheme behind all that, and that whoever figures out your scheme may be able to virtually access any platform or product for which you use the scheme.
That could happen if your scheme is too simple and someone could look at some of your passwords and figure out the base and the transformation rules. Say, if you used it on 2 web platforms developed by the same company, where a rotten employee would peek at unencrypted passwords. But it's still one step better than having the same password for everything, or simple ones.
Also, that's already a risk you run when using a password generator or a master password that may get stolen or broken. And at least with that memory scheme you don't need any additional system.
Many Websites Suck at Implementing Password Systems
A common problem I run into is websites that:
The latter is not so bad: you type in your password as usual and they would just use whatever length they use, right? Wrong. Because often times they'll let you type in a longer password than what they'll store, so that fails, and you won't be able to remember what password length they expect and will have to try everything. Extremely annoying.
About the authorized character set limitation, that can also get quite tricky... Because sometimes some crappy sites will let you type in a password, say everything's OK... and then never let you login again.
Mitigations for that:
Remember: a security question is a password itself. My recommendation: create a secondary password, and don't even give a damn about what the question asks. You may ask me for my dog's name or my mother's maiden name, but I'll answer you with something meaningless (to you) all the same (well, actually, I also have transformation rules in my security questions, but they're different ones).
Ah, and some final words of tonge-in-cheek wisdom:
Wait a week and see if you still have a problem remembering to use the new one first. Repetition creates habits.
I would not worry too much, the 'incorrect password' prompts are so annoying you'll get into the habit.
Or, use any kind of reminder: put a blank sticky note on the monitor edge.
If you're using a web browser to connect to the system you're working with, you can let your browser remember the current password for you. This could have security implications though; be sure to only use this functionality if nobody else can access your browser.