The short answer
- Use a random password for every account your password manager fills in for you. You never type it, so it can be as long and random as the site allows.
- Use a passphrase for the few secrets you have to remember and type yourself: your password manager's master password, your computer login, disk encryption and WiFi you share with guests.
Strength isn't what separates them. A random 16-character password and a random 6-word passphrase are both far beyond what any attacker can brute-force. What separates them is how easy they are for a human to remember and type.
What's the difference?
A random password is a string of characters picked one at a time, like v7Gq!pR2xLm9#tWs. Each character can be any of 60 to 80 options, so every character adds about 6 bits of strength.
A passphrase is a handful of whole words picked at random from a large list, like Glider-Mousy-Umbrella7-Pantry-Eclipse. Our passphrase generator uses the EFF list of 7,776 words, so every word adds about 12.9 bits.
The key word in both is random. A sentence you made up yourself (ILoveMyDogMax2015!) is neither: it's a pattern, and patterns are exactly what cracking tools look for.
How strong is each?
| Type | Example length | Strength | Good for |
|---|---|---|---|
| Random password | 12 characters | ~72 bits | Low-value accounts |
| Random password | 16 characters | ~95 bits | Almost everything |
| Random password | 24 characters | ~144 bits | Anything |
| Passphrase | 4 words | ~52 bits | Low-value accounts only |
| Passphrase | 5 words | ~65 bits | Most accounts |
| Passphrase | 6 words | ~78 bits | Master passwords, device logins |
| Passphrase | 7 words | ~90 bits | Disk encryption |
Every extra bit doubles the number of guesses needed. At 100 billion guesses per second, which is what a serious attacker can reach against a poorly protected leaked database, 65 bits takes years on average and 80 bits takes tens of thousands of years.
Why passphrases are easier to remember
Your memory is good at words and images, and bad at random characters. Five random words can be turned into a silly mental picture ("a glider lands on a mousy umbrella in the pantry during an eclipse") that sticks after a few uses. Sixteen random characters can't.
Passphrases are also easier to type, especially on phones, TVs and game consoles, and easier to read out loud when you need to.
Why random passwords win everywhere else
- They pack more strength into fewer characters, which matters on sites with a maximum length.
- They satisfy picky rules about uppercase letters, digits and symbols out of the box.
- You don't need to remember them if a password manager stores them, so there's no reason to compromise.
Mistakes that make either one weak
- Choosing the words yourself. People pick common, related words. Let a generator pick them.
- Using a famous phrase, song lyric or quote. These are in cracking dictionaries, however long they are.
- Reusing it. The strongest password in the world is only as safe as the weakest site you used it on.
- Going too short. Three or four words, or fewer than 12 characters, isn't enough for anything that matters.
- Relying on substitutions. Swapping
afor@orofor0adds almost nothing; every cracking tool tries it.
A simple setup that works
- Pick a password manager and protect it with a 6-word passphrase you memorise.
- Let it store a different random password of 16+ characters for every site.
- Use passphrases for the handful of other things you type yourself, like your laptop login.
- Turn on two-factor authentication for email, banking and social media.
Want to see how your current password holds up? Try the password strength checker.