Understanding Passphrases
Learn what makes a passphrase secure, when to use one instead of a password, and how to create strong, memorable passphrases.
What is a passphrase?
A passphrase is a sequence of random words used as a password. Unlike traditional passwords that mix random characters (A7#kL2!xP9@), passphrases use complete words that are easier to remember and type.
Example:
- Password:
Kj#9mL2$pQ7@nX4!(16 characters, hard to remember) - Passphrase:
correct-horse-battery-staple(4 random words, easier to remember)
Passphrases became popular after a famous 2007 comic by xkcd illustrated that a sequence of common words can be both more secure and more memorable than a short complex password.
Password vs Passphrase - Which should you use?
| Feature | Password | Passphrase |
|---|---|---|
| Format | Random characters (letters, numbers, symbols) | Random words separated by spaces, hyphens, or CamelCase |
| Length | Typically 8-16 characters | Typically 20-50+ characters |
| Memorability | Hard to remember, easy to forget | Easier to remember (words create mental images) |
| Typing | Prone to typos, especially symbols | Easier to type correctly |
| Best for | Password manager storage, accounts you rarely log into manually | Master passwords, accounts you type frequently, device encryption |
| Entropy | High if truly random, but humans are bad at random | High when using 5+ random words |
When to use a password:
- Stored in a password manager (you don't need to remember it)
- Accounts with character limits (some systems limit to 16-32 characters)
- When maximum symbol complexity is required
When to use a passphrase:
- Master password for your password manager (you'll type this often)
- Device encryption (BitLocker, FileVault, VeraCrypt)
- Accounts you log into manually every day
- When you need to remember it without writing it down
Why are passphrases easier to remember?
The human brain is optimized for remembering stories, images, and concepts - not random sequences.
Cognitive science behind it:
- Chunking: Words are meaningful "chunks" vs individual characters
- Visualization: "horse-battery-staple" creates mental images
- Narrative: Random words can form absurd stories (easier to recall)
Example comparison:
Try to memorize these for 10 seconds, then look away:
Password: Tr0ub4dor&3
- Hard to visualize
- No inherent meaning
- Easy to forget which characters were substituted
Passphrase: correct-horse-battery-staple
- Creates mental image (a horse with a battery and staple?)
- Each word is distinct and memorable
- Absurd combination makes it stick
Why are passphrases secure?
Passphrase security comes from word count and word pool size.
The mathematics:
Our word list contains 7,776 unique words. The number of possible combinations grows exponentially with each added word:
| Word Count | Possible Combinations | Entropy (bits) | Time to Crack |
|---|---|---|---|
| 3 words | 7,776³ = 470 billion | ~39 bits | A few hours |
| 4 words | 7,776⁴ = 3.7 trillion | ~52 bits | A few days |
| 5 words | 7,776⁵ = 28 trillion | ~65 bits | A few years |
| 6 words | 7,776⁶ = 225 trillion | ~78 bits | Hundreds of years |
| 7 words | 7,776⁷ = 1.7 quadrillion | ~91 bits | Thousands of years |
| 8 words | 7,776⁸ = 13 quadrillion | ~104 bits | Millions of years |
Comparison to passwords:
- 8-character password with mixed case, numbers, symbols: ~52 bits
- 4-word passphrase: ~52 bits (equivalent security, easier to remember)
- 6-word passphrase: ~78 bits (stronger than most passwords)
Key insight: Length (in words) beats complexity. A 6-word passphrase is stronger than an 8-character password with symbols, and much easier to remember.
What makes a GOOD passphrase?
Characteristics of strong passphrases:
1. Random, unrelated words
- Words should have no logical connection
- ✅ GOOD:
glacier-toaster-nephew-velvet - ❌ BAD:
red-blue-green-yellow(related concepts)
2. Minimum 5-6 words
- Fewer than 5 words = vulnerable to brute-force
- 5 words = decent security (~65 bits)
- 6+ words = strong security (~78+ bits)
3. Unpredictable word choice
- Avoid common nouns (house, dog, love)
- Use unexpected combinations
- ✅ GOOD:
monocle-flamingo-tornado-basement
4. No personal information
- ❌ Never use: names, birthdays, addresses, pet names
- These are easily guessed by people who know you
5. Not a common phrase or quote
- ❌ BAD:
may-the-force-be-with-you(famous quote) - ❌ BAD:
to-be-or-not-to-be(Shakespeare) - Attackers use phrase dictionaries
Pro tip: Use a passphrase generator (like ours) to ensure true randomness. Humans are terrible at being random - we unconsciously follow patterns.
What makes a BAD passphrase?
Common mistakes that weaken passphrases:
1. Common phrases or quotes
- ❌
once-upon-a-time - ❌
may-the-force-be-with-you - ❌
to-infinity-and-beyond - These are in attacker dictionaries
2. Song lyrics or movie lines
- ❌
is-this-the-real-life-is-this-just-fantasy - ❌
here-comes-the-sun - Pop culture references are predictable
3. Personal information
- ❌
john-mary-1990-boston - ❌
fluffy-max-sunny-2024(pet names) - Social engineering can guess these
4. Too short
- ❌
horse-battery-staple(only 3 words, ~39 bits) - Can be brute-forced in hours
- Minimum 5 words recommended
5. Related words
- ❌
monday-tuesday-wednesday-thursday(days) - ❌
red-blue-green-yellow-orange(colors) - ❌
cat-dog-bird-fish-horse(animals) - Related words reduce entropy
6. Simple patterns
- ❌
one-two-three-four-five - ❌
first-second-third-fourth - Patterns are easy to guess
Real-world example: The passphrase correct-horse-battery-staple from the famous xkcd comic is now terrible because it's well-known and included in attacker dictionaries. Never use famous example passphrases!
Passphrase examples
Good passphrases (random, 6+ words):
glacier-toaster-nephew-velvet-monocle-flamingobasement-tornado-spaghetti-witness-penguin-envelopetypewriter-jellyfish-astronaut-cactus-notebook-thunderCorrectHorseBatteryStapleReplacementExampleHere(CamelCase)
Bad passphrases (common, short, or personal):
password123(common password, not a real passphrase)let-me-in-now(common phrase)iloveyou-mom(personal, short)one-two-three-four-five-six(pattern)red-blue-green-yellow(related words, only 4)may-the-force-be-with-you(famous quote)
Separator comparison:
Same 5 words, different formats:
| Format | Example | Pros | Cons |
|---|---|---|---|
| Hyphen | correct-horse-battery-staple |
Clear word boundaries, easy to type | Slightly longer |
| Space | correct horse battery staple |
Most readable, natural | Some systems don't accept spaces |
| CamelCase | CorrectHorseBatteryStaple |
Compact, no special chars | Harder to read, case sensitivity matters |
| No separator | correcthorsebatterystaple |
Shortest | Word boundaries unclear, harder to remember |
Our recommendation: Use hyphens for the best balance of readability, security, and compatibility.
