Passphrases vs Random Passwords: Which Should You Use?

Published November 8, 2026 · 6 min read · By KeyGuard Pro

A random string like vK9#mQ2!xT7p is strong but nearly impossible to remember. A passphrase built from several unrelated words is longer, but much friendlier to the human brain. Both can be secure. Here is when to choose each, and how to build a passphrase that is actually strong.

What a passphrase is

A passphrase is a password made of several words. The strong version is built by choosing the words randomly from a fixed list, not by picking words that appeal to you. The classic method is Diceware, invented by Arnold Reinhold in 1995: you roll five dice to select each word from a list of 7,776 entries (6⁵). A later list published by the Electronic Frontier Foundation keeps the same size but chooses words that are easier to spell and tell apart.

The math behind it

Each word chosen from a 7,776-word list adds log₂(7776), about 12.9 bits of entropy. That means:

• 4 words: about 51.7 bits
• 5 words: about 64.6 bits
• 6 words: about 77.5 bits
• 7 words: about 90.4 bits
• 8 words: about 103.4 bits

For comparison, a random 12-character password using letters and digits has about 71.5 bits, and a random 16-character password using every symbol has about 105 bits. A six-word passphrase is therefore in the same range as a 12-character random password, and seven or eight words match a long random string.

Why randomness is the whole point

The numbers above assume the words are selected at random and the attacker knows the word list but not which words you chose. If you pick the words yourself, that assumption fails. People favor common words, personal themes, and phrases from songs, books and films. A phrase like "to be or not to be" is long, but it is in every attacker's quote list.

Turning a favorite sentence into a passphrase by taking the first letters of each word, a trick sometimes taught, has the same weakness. If the sentence is well known, the result is guessable, and if it is personal, it is often guessable by someone who knows you.

When a passphrase is the better choice

• Your password manager's master password. You have to type and remember this one, so a long random passphrase is ideal.
• Your device or disk encryption password. Again, you type it often and cannot let a manager fill it in.
• Wi-Fi passwords that guests need to read aloud or type on a television.

When a random string is the better choice

• Everything your password manager fills in for you. If you never type it, memorability does not matter, and a 20-character random string packs more strength into less length.
• Sites that limit password length or reject spaces and hyphens, where a passphrase might not fit.

How to build a good passphrase

1. Use a real random source. Dice and a published word list are fine, and so is a generator that uses your device's secure random number generator.
2. Use at least six words for ordinary accounts and seven or eight for a master password.
3. Do not "improve" the result by swapping letters for symbols. It adds little strength and makes the phrase harder to remember.
4. Do not re-roll until you get words you like. Choosing among results turns a random process into a human one.
5. Write it down the first few times if you have to, and keep the note somewhere physically safe until you know it by heart.

Memory tricks that work

The brain remembers stories better than lists. Linking your random words into a vivid, silly scene helps: if the words are "lantern", "walrus", "teapot" and "granite", picture a walrus holding a lantern over a granite teapot. The scene is for your memory only. The passphrase itself remains the four words exactly as drawn.

The bottom line

Use random strings wherever software types the password for you, and random-word passphrases wherever you type it yourself. Either way, the strength comes from the randomness of the process and from length. Read about how entropy is calculated if you would like to check these numbers yourself.