What a passphrase is, why four random words beat P@ssw0rd!, and how to make one

"correct horse battery staple" is easier to remember than "Tr0ub4dor&3" and much harder to crack — the point of a 2011 cartoon that changed password advice. A passphrase is several random words; its strength comes from how they're chosen, not from symbols. This guide explains the counting and the method behind the passphrase generator; How long should a password be? covers the password side.

What a passphrase is

A passphrase is a password made of words — typically four to six, chosen at random from a large list, separated by spaces or hyphens. It is long (20–40 characters), memorable because words are what memory is built for, typeable, and strong for the same reason a long random string is strong: the number of possibilities an attacker must try. The catch is "at random": a phrase you thought of (a lyric, a quotation, your children's names) is in every cracking dictionary, and its strength is close to zero.

Entropy: counting the guesses

Password strength is measured in bits of entropy: log₂ of the number of equally likely possibilities. A random 8-character password from 95 printable characters has 95⁸ ≈ 6.6 × 10¹⁵ possibilities, about 52.6 bits. Four words from a 7,776-word list have 7,776⁴ ≈ 3.7 × 10¹⁵, about 51.7 bits — nearly the same, and the four words are far easier to remember. Each added word adds 12.9 bits (multiplies the guesses by 7,776); each added random character adds 6.6. At a billion guesses per second (a fast offline attack on a weak hash), 52 bits takes about 70 days on average; 65 bits (five words) about 600 years; 77 bits (six) several hundred thousand years. Online logins with rate limits are far slower to attack, which is why even four words is plenty there.

Why random words work

The attacker knows the method — that's the assumption cryptographers make — and it doesn't help: knowing the list and the count still leaves 7,776⁴ phrases to try. The words must come from a true random source: dice (Diceware, 1995, five dice per word against a numbered list), or a generator using the operating system's cryptographic randomness, as the one here does. Capitalisation, digits and symbols add a little and are fine when a site demands them; they are not where the strength lives. The EFF's word lists improved on Diceware by choosing words that are common, distinct, easy to spell and free of homophones — the list this generator uses.

How many words

• Four words (~52 bits): fine for accounts with rate limiting and for anything a password manager also protects.
• Five words (~65 bits): the sensible default for the passwords you have to remember — your computer login, your password manager's master password.
• Six or more (~78+ bits): encryption keys, disk encryption, recovery passphrases; anything an attacker could copy and attack offline for years.

The password strength checker estimates the entropy of what you have; a memorised five-word phrase usually beats it.

Where passphrases fit

The modern arrangement is: one strong passphrase you memorise for the password manager, a unique random password per site generated and stored by the manager (the password generator), two-factor codes on important accounts (How authenticator app codes work: TOTP, explained), and passkeys where sites offer them. Passphrases also suit the places managers don't reach — the disk-encryption prompt at boot, a Wi-Fi network shared by voice (the Wi-Fi QR generator avoids the voice), a shared team credential. Never reuse one across sites, never write it in a note titled "password", and if a site caps length at 16 characters, that site has the problem.