Passphrases: security you can actually remember
A famous XKCD comic settled it forever: "correct horse battery staple" — four random words — is both stronger and easier to remember than "Tr0ub4dor&3". That idea has a name: the passphrase.
Why it works
Security is measured in entropy: how many combinations an attacker who knows your method would have to try. With a 7,776-word list (the Diceware standard):
- 4 words ≈ 51 bits: acceptable for normal accounts.
- 5 words ≈ 64 bits: good for almost everything.
- 6 words ≈ 77 bits: master-password or disk-encryption grade.
And here is the key: that entropy holds even if the attacker knows you used dictionary words, because what counts is the random choice, not the secrecy of the method.
The non-negotiable condition: randomness
"my dog eats kibble every morning" is NOT a secure passphrase: it has grammar and related words — exactly what phrase-attacks try. The words must be chosen at random, with no relation between them:
window-tractor-cloud-93-sardine ✔ my cat is called luna ✘
How to create yours: the Diceware method
- Get a Diceware word list (7,776 words numbered 11111 to 66666).
- Roll 5 dice (or one die 5 times) per word and look up the resulting number.
- Repeat until you have 4-6 words. Dice guarantee true randomness with no "words I like" bias.
- Optional: add a number or symbol between words to satisfy website rules.
When to use a passphrase vs a random password
| Situation | Recommendation |
|---|---|
| Accounts stored in a manager | Random 16-20 character password (you never need to recall it) |
| The manager's master password | 5-6 word passphrase |
| Computer / disk encryption | 6-word passphrase |
| Home WiFi | 4-5 word passphrase (easy to dictate and to type on a TV) |
The optimal strategy combines both: passphrases for what your head must hold, random generator passwords for everything the manager holds.
💡 Try it yourself: use our Strong password generator — free, no sign-up, no watermarks.
Frequently asked questions
Aren't 5 dictionary words easy to guess?
No: with 7,776 possible words, 5 random ones give 7,776⁵ ≈ 2.8 × 10¹⁹ combinations (about 64 bits). Even knowing the exact list, trying them all is infeasible.
Can I pick the words "randomly" in my head?
Better not: humans are terrible at randomness and drift toward common, related words. Use dice, your manager's passphrase feature, or a random generator.
What language should the words be in?
Irrelevant to security: entropy depends on list size and randomness, not language. Use your own language if it helps you visualize and remember the phrase.
Do websites accept passwords with spaces?
Many do, but not all. If a site rejects spaces, join the words with hyphens or dots: tractor-cloud-sardine-93. Security is identical.