Password or passphrase?

Contents

• What makes a password hard to guess
• Use a random password when
• Use a passphrase when
• Random means more than unfamiliar
• The site rejected your password
• Password vs passphrase at a glance
• What to remember
• References

You need a new password. The site wants uppercase, a number, and a symbol. You are about to decorate a familiar word with 1! and call it done.

That may satisfy the form without making the result difficult to guess.

Short version. Use a long, generated password for accounts your password manager can fill. Use a randomly generated passphrase when you need to type or remember it. Both need randomness, sufficient length, and a different value for every account.

A passphrase is a password made of words. The choice is about how you generate and use it.

What makes a password hard to guess

XKCD's familiar comparison—Tr0ub4dor&3 versus correct horse battery staple—illustrates the difference between decorating a word and randomly selecting several words.

Never use either example: both are public.

Attackers try common words and predictable substitutions early. Replacing a with @ does not make a familiar word random. Symbols do contribute when a generator selects them unpredictably.

Length helps when it adds uncertainty. A long film quotation may be easier to guess than a shorter generated password. Count the unpredictable choices, not just the characters.

Use a random password when

Your password manager stores and fills it. If you rarely type the password, it does not need to be memorable.

Use 20 or more generated characters where the service permits them. Let the generator meet any character requirements, then save the result in your manager. Generate a fresh value for every account.

Vishow Tools' Password Generator creates character passwords in the browser, not word-based passphrases. Your manager's built-in generator is also convenient because it can generate and save together.

Use a passphrase when

You need to type or remember it: a password manager's master password, a computer-login password, or a disk-encryption password.

Random-word passphrases are generally easier to type than mixed-character passwords and easier to copy accurately from paper. Memorising one still takes practice.

For a concrete method, EFF recommends at least six randomly selected words from its 7,776-entry long wordlist. Use a suitable passphrase generator or follow its dice instructions. Keep any written backup securely stored.

Random means more than unfamiliar

Song lyrics, film dialogue, names, and personal sentences contain patterns. Words you chose yourself are not equivalent to independently generated words, however unusual they feel.

Both the wordlist size and word count matter. Four words from EFF's long list provide about 52 bits of selection entropy; six provide about 78. These numbers describe possible combinations, not a guaranteed cracking time.

A website can limit login attempts. Stolen password hashes can be attacked offline without those limits, making the storage method important too.

Keep the generated words and their order. Invent a story afterwards to remember them, rather than choosing words to fit a story.

The site rejected your password

Read the reason. Rejecting a common or previously breached password is useful protection. Restrictive length or character rules are a different issue.

A short cap limits your security options and is a reason for caution, but it does not reveal how the password is stored.

If a passphrase will not fit, generate a character password within the accepted limits. Avoid cutting a phrase down to a few predictable words.

If you reuse passwords, replace those first—with a strong, unique password for each account. Uniqueness helps protect your other accounts after a breach; it does not protect the account already compromised.

Related: SHA-256 vs SHA-512 explains why plain fast hashes alone are unsuitable for password storage.

Password vs passphrase at a glance

What to remember

• Length, randomness, and uniqueness work together.
• Use generated characters for autofill and generated words when memory matters.
• Public examples are teaching aids, not usable passwords.
• Neither form prevents phishing. Enable multi-factor authentication where available.

Generate character passwords with the Password Generator, or use EFF's dice method for passphrases. Save the result securely before you need it.

References

• NIST SP 800-63B-4 — Password requirements
• EFF — Dice-generated passphrases
• EFF — Wordlist size and random passphrase strength
• OWASP — Authentication Cheat Sheet
• OWASP — Password Storage Cheat Sheet