Which is stronger, P@ssw0rd or four ordinary words picked at random? The words win easily, and you will find them far easier to type. This guide from our password basics series explains why.
What a passphrase is
A password is often a single scrambled string. A passphrase is a password built from several words, such as lantern-oboe-gravel-mitten-sundial. Do not use that example, since it is now published on the internet.
It works the same way as any other password. You type it into the same box. The difference is how it is made and how much easier it is to live with.
- A common word with predictable swaps
- On every attacker's list
- Hard to type, easy to forget
Guessed almost at once
- Five words: about 65 bits of strength
- Six words: about 78 bits
- Easy to picture, easy to type
Strong if truly random
Why random words work
The strength comes from how many choices were available, not how odd the result looks. The well-known EFF word list has 7,776 words, and a dice roll picks each word with equal chance:
| Random words | Possible combinations | Strength |
|---|---|---|
| 3 | About 470 billion | 39 bits |
| 4 | About 3.7 quadrillion | 52 bits |
| 5 | About 28 quintillion | 65 bits |
| 6 | About 221 sextillion | 78 bits |
For comparison, 8 random characters from the whole keyboard give about 52 bits, the same as four random words. Five words are already well ahead, and they are much easier to remember. If "bits" is a new idea, each extra bit simply doubles the number of guesses needed, as password strength explained shows.
The attacker can even know you used this method and which list you picked. It does not matter, because the security comes from the randomness, not from keeping the method secret.
The one rule: it must be random
People are poor at being random. If you choose words yourself, you will lean towards common words, words that fit together, and things you care about. An attacker's guessing tools know this.
These are not random:
- A line from a song, film, prayer or book.
- A sentence that makes sense, such as
my dog loves the beach. - Your family's names, your street or your team.
Use a real source of randomness. Physical dice with a word list work well, and so does the passphrase option in a password manager's generator. How to create a strong password walks you through both.
How does this compare with "three random words"?
The UK's NCSC recommends three random words as an easy method for ordinary accounts, especially for people who do not use a password manager. It is a realistic improvement over most people's habits, and much better than a pet's name with a number on the end.
We suggest going further for your most important secrets. The table shows why: each extra word multiplies the work by 7,776. Words you pick yourself will also be weaker than the table suggests, so an extra word or two is cheap insurance.
When to use a passphrase
Use one wherever you must remember the secret or type it by hand:
- Your password manager's master password.
- Your computer login.
- Your main email account, if you do not keep it in a manager.
Everywhere else, a password manager can generate and fill long random passwords, so you never need to see them.