Passphrases: Strong Passwords You Can Remember
Password Generator ·
Random passwords are strong, but they are miserable to type and impossible to remember. Passphrases give you the best of both worlds: serious cryptographic strength and something your brain can actually hold onto. This guide explains what a passphrase is, why a few random words can be stronger than a tangle of symbols, and how to create one in seconds.
In short: a passphrase is several random words strung together, like |
What is a passphrase?
A passphrase is a password made of several unrelated words chosen at random, usually joined by hyphens, spaces or digits — for example correct-horse-battery-staple or Brave-Otter-Lantern-92. Because each word is picked at random from a large dictionary, the result is unpredictable to an attacker. But because the building blocks are real words, it is dramatically easier to remember than a jumble of symbols. The key word is random: a passphrase only works if a machine picks the words, not you.
Why passphrases are strong
Strength comes from entropy — the number of possibilities an attacker has to search through. When you pick words at random from a list of, say, 7,776 words (the classic Diceware list), each word adds about 13 bits of entropy. Bits add up fast, and because each bit doubles the search space, a handful of words quickly becomes uncrackable.
| Number of random words | Approx. entropy | Strength |
|---|---|---|
| 3 words | ~39 bits | Weak — avoid |
| 4 words | ~52 bits | Good for everyday accounts |
| 5 words | ~65 bits | Strong |
| 6 words | ~78 bits | Very strong — ideal for a master password |
Add a number or a symbol and the entropy climbs further. A six-word passphrase is comfortably beyond the reach of any realistic brute-force attack, which is why security experts recommend them for the passwords that matter most.
The Diceware method
Passphrases are often called Diceware passphrases, after a method invented in the 1990s. The original idea is delightfully low-tech: roll a physical die five times to get a number, then look that number up in a list of 7,776 words. Repeat for each word. The dice guarantee true randomness. Our passphrase generator does the same thing instantly using your browser's secure random number generator instead of dice — same principle, no rolling required.
Passphrase vs. random password
| Random password | Passphrase | |
|---|---|---|
| Example | q7!Kp2$wZr9#tLxV | Brave-Otter-Lantern-92 |
| Strength | Excellent | Excellent |
| Easy to remember | No | Yes |
| Easy to type | No | Yes |
| Best for | Accounts a manager fills in | Passwords you type from memory |
Neither is "better" outright — they are tools for different jobs. Use a fully random password for the hundreds of accounts your password manager handles, and a passphrase for the few you must type yourself.
When to use a passphrase
Passphrases shine wherever you actually have to type or remember the secret:
- Your device login — laptop, phone or desktop.
- Your password manager's master password, the one key that protects all the others.
- Your Wi-Fi network key, which guests have to type.
- Encryption passwords for backups or drives.
For everyday website accounts that your manager fills in automatically, a fully random password is still the ideal choice.
Passphrase dos and don'ts
- Do let a generator choose the words at random.
- Do use at least four words — five or six for anything important.
- Don't make up your own "random" words; human choices are predictable.
- Don't use a famous quote, song lyric or movie line — those are in cracking dictionaries.
- Don't reuse a passphrase across accounts, just as with any password.
Create a passphrase now
Our passphrase generator builds memorable passphrases right in your browser — choose the number of words and the separator, optionally add a number or symbol, and copy one with a click. Nothing is sent over the network. Once you have one, confirm its strength with the password strength checker, and make sure it has not been exposed with the password leak check.
Frequently asked questions
What is a passphrase?
A passphrase is a password made of several unrelated words chosen at random, such as Brave-Otter-Lantern-92. It is long and hard to guess, yet easier to remember than a random string of characters.
Are passphrases more secure than passwords?
A passphrase can be just as secure as a random password, and sometimes more so, because length drives strength. A four-to-six-word random passphrase has very high entropy while remaining easy to remember, which makes it ideal for passwords you must type by hand.
How many words should a passphrase have?
Use at least four random words for everyday accounts and five or six for important ones like a password manager's master password. Each additional word makes the passphrase exponentially harder to crack.
Can I make up my own passphrase?
It is far safer to let a generator pick the words. People unconsciously choose predictable words and patterns, which lowers entropy. A generator draws each word at random from a large list, guaranteeing the unpredictability that makes a passphrase strong.
Is "correct horse battery staple" a good passphrase?
The concept it popularised — four random common words — is sound, but that exact phrase is now famous and sits in every cracking dictionary, so never use it. Generate your own random words instead.
Should I use a passphrase or a password manager?
Both. Use a passphrase for your password manager's master password and your device logins, and let the manager generate fully random passwords for every other account.