What is a Passphrase and Why Use It

What a passphrase is

A passphrase is a password made of several words instead of a single short string — for example correct-horse-battery-staple. The point is not that words are magic; it is that a passphrase can reach the length needed to resist offline cracking while still being typeable and, if you choose the words the right way, memorable. It is a way of packaging entropy (unpredictability) into a form humans tolerate.

Why length beats complexity

The strength of a secret is measured in bits of entropy — how many guesses an attacker needs on average. Attackers with a leaked password-hash file can try billions of candidates per second on a GPU, and they try dictionary words, names, dates, and known-breach passwords first. A short "complex" password like P@ssw0rd1 has very little real entropy because it follows a predictable pattern. Adding length adds far more resistance than sprinkling in symbols: each extra random element multiplies the search space.

This is why current guidance from NIST (SP 800-63B) drops mandatory complexity rules and periodic forced resets, and instead asks for a longer minimum length and a check against breach lists.

How to create a strong passphrase

Use random words, not a phrase you invented. A sentence you can think of — a song lyric, a movie quote, a saying — is also a sentence a cracking wordlist already contains. Instead, let a computer pick the words:

• Pick at least 5–6 words chosen uniformly at random from a large list. The EFF Diceware list has 7,776 words, so each word adds ~12.9 bits; six words give about 77 bits, which is comfortably beyond offline brute force.
• Keep the separators simple (spaces or hyphens). A separator character adds negligible entropy — the word count is what matters.
• Don't "personalise" it with your name, a birthday, your address, or a meaningful year. That only removes randomness.
• Use a different passphrase for every account that matters, and store them in a password manager. You only need to memorise the two or three that unlock everything else: your device login, your password manager, and your primary email.

Our free passphrase generator does this in your browser using the EFF Diceware list and shows the entropy in bits; the strong password generator covers sites that cap length or demand character classes.

Where passphrases fit — and where they don't

A passphrase is the right tool for secrets a human must type or remember: your OS login, disk-encryption key, password-manager master secret, and SSH key passphrase. For ordinary website logins, a password manager generating long random strings is stronger still, because no memorability constraint applies. A passphrase is not a replacement for multi-factor authentication — use both on email, banking, and anything with payment access, so a single leaked secret isn't enough to get in.

The cost of a weak or reused secret

Reuse is the bigger risk than weakness. When one site is breached, attackers replay the leaked email/password pair against banks, email providers, and retailers — "credential stuffing". A unique passphrase per account contains the damage to the one service that leaked. A weak unique password, by contrast, can be cracked from its stolen hash in minutes and then used the same way.

What's my IP address?