Passphrases vs Random Passwords: Which Should You Use?

A passphrase is a password made from several words, such as "copper-lantern-orbit-velvet-harbor". A random password is a string of random characters, such as "v7#Qe9!pLm2&xR4w". Both can be very strong; the right choice depends on how you use it.

How strong are passphrases?

Strength depends on the size of the word list and the number of words, provided the words are chosen at random. Using a list of 7,776 words (the size of the popular Diceware list), each word adds about 12.9 bits:

Six random words give similar strength to a random 12-character password using all character types.

When passphrases win

• Master passwords for password managers, which you must remember.
• Device logins you type many times a day.
• Passwords you may need to read aloud or type on a TV remote.

When random passwords win

• Every account stored in a password manager. You never type them, so a compact random string from a password generator is ideal.
• Sites with short maximum lengths, where a passphrase would not fit.

The golden rule: you must not choose the words

A phrase you invent, such as a song lyric or a favorite quote, is far weaker than random words because attackers use phrase dictionaries too. Use dice or a trusted generator to pick words at random, and do not "improve" them by swapping in more meaningful words.

A balanced setup

Use one strong random passphrase for your password manager, then let the manager store random generated passwords for everything else.

Frequently asked questions

Passphrase vs password: which is better?

In the passphrase vs password debate, both are strong when random. Use a passphrase for things you type and remember, such as a master password, and random passwords for everything stored in a password manager.

What is a Diceware passphrase?

A Diceware passphrase is created by rolling dice to pick words from a numbered list of 7,776 words. Each word adds about 12.9 bits of entropy, so six words give about 78 bits.

How to create a passphrase?

To create a passphrase, use a passphrase generator or dice to pick five to seven random words, and join them with hyphens or spaces. Do not choose the words yourself. A random word password like this is a memorable password that is still strong.

How to remember strong passwords?

You don't need to remember most of them. The trick for how to remember strong passwords is to memorize only one long passphrase for your password manager and let the manager store the rest. Should I write down my passwords? A written list kept safely at home is better than reusing passwords, but a password manager is better still.