Guides
Passphrase or random password: which should you use?
Both can be strong. They suit different jobs.
Use a random character password for accounts kept in a password manager. Use a passphrase of five or six random words for the few secrets you must type from memory, such as the master password of the manager itself.
The math
Strength is the number of equally likely possibilities, usually written in bits. A random character password drawn from 94 printable characters gives about 6.55 bits per character, so 16 characters is about 105 bits. A passphrase picks words from a list: the EFF large word list has 7,776 words, which is about 12.9 bits per word.
| Secret | Possibilities per element | Total |
|---|---|---|
| 12 random characters (94 symbols) | about 6.55 bits | about 79 bits |
| 16 random characters (94 symbols) | about 6.55 bits | about 105 bits |
| 5 random words (7,776 list) | about 12.9 bits | about 65 bits |
| 6 random words (7,776 list) | about 12.9 bits | about 78 bits |
| 7 random words (7,776 list) | about 12.9 bits | about 91 bits |
Which one to pick
- Password manager entries: a long random password. You never type it.
- Master password, device login, disk encryption: a passphrase of six or more random words. It is easier to remember and type.
- A site with strange rules (maximum length, required symbols): use the random password with the options it asks for.
The words must be random
A passphrase is only as strong as how it was chosen. A quotation, a song line or words you picked yourself are predictable. The generator on the home page draws each word at random, which is what the numbers above assume.
Frequently asked questions
Is a passphrase of common words really secure?
Yes, when the words are chosen at random from a large list and the phrase is long enough. The security comes from the number of possible combinations, not from the words being unusual.