Password vs Passphrase: Which Is Safer?

You have probably been told to use a "strong password" a hundred times. You have probably also been told to use a passphrase. Both sound right, and the advice seems to pull in opposite directions: one says add symbols, the other says use plain words.

Here is the plain answer. Either one can be very strong, and either one can be useless. What decides it is whether the secret is long, random and used on one account only. The rest of this post shows you how to pick, with real numbers instead of rules of thumb.

What is the difference?

A password is a string of characters, such as 7vQ#m2Lx$rT9. A passphrase is a few words joined together, such as lamp-orbit-pepper-cloud-river. Both are just secrets that a website checks. The only real difference is how you build them and what they are like to live with.

How strong is each one, really?

Security people measure strength in bits of entropy. Every extra bit doubles the number of guesses an attacker needs, so small differences add up fast. The maths is simple when the secret is truly random:

• Each random character from the 94 printable keyboard symbols adds about 6.55 bits.
• Each random word from a 7,776-word list adds about 12.9 bits.

That is why a handful of words holds up so well. One word is worth about two characters.

Bits are hard to picture, so here is what they mean in time. The table assumes an attacker who stole a site's password database and can try 10 billion guesses per second against a fast hash, and who finds your secret after trying half the possibilities on average. Sites that store passwords with slow hashes such as bcrypt or Argon2 are much tougher, but you never know which kind a site uses, so plan for the bad case.

Look at the 4-word row. Four words feels long and safe, yet it falls in days against this attacker. Five is the floor and six is the comfortable choice. If you are protecting something that matters for a decade, use seven.

Side by side

Why picking the words yourself fails

The strength numbers above assume the words were chosen by chance. People are bad at chance. We pick song lyrics, film quotes, pet names, places we love and phrases that mean something. Attackers know this, and their guessing tools try common phrases and quotes long before random combinations.

The same goes for adding tricks. Changing a to @ or adding 1 at the end barely helps, because attackers' tools already try those swaps. If a site demands a number or symbol, add one at the end, but do not count on it to save a weak secret. A sixth word is worth far more than a symbol.

What about passwords on sites that cap the length?

Some sites still stop you at 12 or 16 characters, or insist on a symbol. In that case a passphrase will not fit and a random password is the better tool. Generate a 16-character one if the site allows it, or 12 at the very least. The point is to match the secret to the job.

Which one should you use?

1. Let a password manager handle most accounts. It creates a long random password for every site, so you never have to remember them.
2. Use a passphrase for the few you must type yourself. Your manager's master password, your phone or laptop login and your email recovery are good fits.
3. Make it long enough. Six random words, or 16 random characters, is a safe target for important accounts.
4. Never reuse it. One breach should not open a second door.
5. Turn on two-factor authentication. A strong secret still helps less if someone tricks you into typing it on a fake login page.

If you want a passphrase to start from, the generator below picks words from the EFF long word list (7,776 words) with your browser's secure random number generator, and shows the exact entropy of what it makes. Nothing is sent to a server.

Need a random password instead, for a site with strict rules?

Already have a password you use? Paste it into the checker to see how it holds up.

What official guidance says

The US standards body NIST publishes the digital identity guidelines that many companies follow. Its latest guidance, NIST SP 800-63B, says a password used on its own should be at least 15 characters long, and sites should allow at least 64. It also tells sites not to force odd composition rules like "one capital and one symbol", and not to force routine password changes. The message matches this post: length wins, and rules that push people toward predictable tricks do not help.

Want the full picture on length? Read the next post:

Common questions