Passphrases vs Passwords: Which to Use

A passphrase built the Diceware way — several words chosen at random from a large list — gets its entropy from the number of words and the size of the list. With a 7,776-word list, each word adds about 12.9 bits, so four words give roughly 52 bits, five give about 65, and six give about 77. The words must be chosen randomly by a tool; a phrase you compose from a favourite quote or song lyric has almost no entropy, because it is guessable.

The EFF publishes two lists worth knowing by name. The large list holds 7,776 words — five dice rolls each — and contributes 12.92 bits per word. The short list holds 1,296 words, four rolls, 10.34 bits per word; its entries are at most five letters long and no word is a prefix of another, which makes it faster to type and safe to autocomplete after three characters. Six words from the large list is about 77.5 bits; seven from the short list is about 72.4.

The original Diceware procedure uses five physical dice and a printed list, and it remains the strongest option for a secret that guards everything else, because it depends on no software at all. For anything short of that threat model, a generator drawing from the operating system's cryptographic random source produces words that are exactly as unpredictable and takes seconds rather than several minutes of rolling and looking up.

Random character passwords pack the most entropy into the fewest characters, which is ideal when a machine remembers them for you. Passphrases spread the same entropy across more characters but in a form a human can actually hold in memory and type on a phone keyboard. A 20-character random string and a six-word passphrase might both clear 75 bits; one is easier to store, the other easier to recall.

The real differences show up at the moment of input rather than on paper. A phrase of lowercase words survives being typed on a phone, dictated to a television, or read aloud over a call — none of which is true of a twenty-character symbol string. It is also far more resistant to transcription errors and to the silent mangling that autocorrect and some poorly written password fields apply to unusual characters. The price is length: the same strength costs three to four times as many keystrokes.

Use random character passwords for everything a password manager stores for you — that is the vast majority of your accounts. Reserve passphrases for the handful of secrets you must type from memory: the master password to your password manager, your device login, or a disk-encryption key. For those, a six-word passphrase is both strong and practical.

Two practical caveats. Some services still cap passwords at 16 or 20 characters, which rules out a six-word phrase entirely — that is a reason to switch to a dense random string for that account, not a reason to shorten the phrase. And a passphrase is only worth memorising if you rehearse it: type it from memory a few times on the day you create it, again the next day, and keep a written copy somewhere physically secure until it has genuinely stuck.

A list in your own language works exactly as well, provided it is a real list of known size and the words are drawn from it at random: the entropy comes from the count of words and the size of the list, not from which language they happen to be in. What does not work is mixing languages by hand to feel clever. That is a human choice again, and human choices are precisely what the procedure exists to remove.

People often decorate a generated phrase: capitalising each word, joining them with hyphens, appending a digit to satisfy a form. Assume the attacker knows the scheme, because the scheme is not the secret. Capitalising the first letter of every word unconditionally adds exactly nothing, a chosen separator adds a bit or two at most, and a trailing digit adds about 3.3 bits. Adding a seventh word adds 12.9 bits and takes less thought. Decorate only when a site's composition rules force you to.

Almost every weak passphrase fails at the same point: the words were not chosen by a random process. Song lyrics, film titles, opening lines and proverbs are already in cracking wordlists, and a phrase assembled so that it 'makes sense' draws from a far smaller pool than the list it nominally came from, because natural language is heavily redundant and the second word constrains the third. Four random words is the floor at roughly 52 bits — enough to be annoying, not enough for a master password. Five or six is where a phrase becomes genuinely expensive to attack.