Glossary Security

Passphrase

A passphrase is a password made of several randomly chosen words, long enough to be strong yet easier to remember and type than a random string of symbols.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

A passphrase gets its strength from length and randomness rather than from unusual characters. Each word picked at random from a list adds log₂(list size) bits of Entropy. With the standard 7,776-word Diceware list that is about 12.9 bits per word, so six words give roughly 77.5 bits. The words must be chosen by a random process, not by the user.

Why it matters

Passphrases suit the few secrets you must remember, such as the master password of a password manager or a device login, because they resist Brute-force attack attacks well and are easier to type than random symbols. For everything else, let a password manager store a long random password.

Example

copper-lantern-orbit-pickle-meadow-tunnel is six random words separated by dashes. A famous quote or a line of song lyrics is not a passphrase in this sense, because it was not chosen at random and attackers try known phrases first.

Common confusion

Length counts, but only if the words are random. Swapping letters for symbols (p@ssw0rd) adds almost nothing because attackers try those substitutions first.

AdSense Placeholder
Slot: footer_leaderboard