Passphrases vs. passwords
Both are strong when they're random. The difference is who has to type or remember them.
What each one is
A random password is a string of characters chosen by a computer, like
q7#Lm2vR!xT9pW4e. A random passphrase is a few words chosen by a
computer from a fixed list, like orbit-cactus-mellow-tundra-pebble-scarf. Both get
their strength from the same place: the number of equally likely possibilities an attacker has
to search through.
How they compare on strength
Each word from a 7,776-word list adds about 12.9 bits of strength. Each random character from letters, numbers and symbols adds about 6.5. So a passphrase needs fewer pieces but more letters overall to reach the same strength:
| Passphrase | Strength | About as strong as a random password of |
|---|---|---|
| 4 words | 51 bits | 8 characters |
| 5 words | 64 bits | 10 characters |
| 6 words | 77 bits | 12 characters |
| 7 words | 90 bits | 14 characters |
| 8 words | 103 bits | 16 characters |
Six words (77 bits) is a good default for anything important; use seven or eight for a password manager's master password. The same figures for random passwords are in our guide to how long a password should be.
When a passphrase is better
- You have to remember it: your password manager's master password, your computer login, full-disk encryption.
- You have to type it by hand, especially on a phone or TV, where symbols mean switching keyboards.
- You have to read it out or share it, like a Wi-Fi password for guests.
When a random password is better
- A password manager fills it in. You never see or type it, so a short, dense random password is simplest.
- The site limits length to 16 or 20 characters, which can be too short for a strong passphrase.
- The site insists on symbols or digits. You can add them to a passphrase, but a random password already has them.
The one rule for both: let a computer choose
Phrases people choose themselves, such as song lyrics, quotes or "correct horse battery
staple" after it became famous, are among the first things attackers try. Likewise, a
password you invent and then dress up with substitutions (P@ssw0rd!) follows
patterns cracking tools know by heart. The strength figures above only hold when every word or
character is picked at random.