Two approaches to one task. A random password such as 7kJ#pQ2vLm@9xZaR and a passphrase such as “anchor-breeze-sealwax-noon-nettle” deliver comparable strength but behave completely differently in daily use.
Strength, counted honestly
The entropy of a passphrase is counted in words, not letters. With a 2048-word list each word contributes exactly 11 bits, whether it is long or short.
| Option | Entropy | String length |
|---|---|---|
| 4 words | 44 bits | ~24 characters |
| 6 words | 66 bits | ~36 characters |
| 7 words | 77 bits | ~42 characters |
| 12 random characters | 79 bits | 12 characters |
| 16 random characters | 105 bits | 16 characters |
First conclusion: seven words roughly equal twelve random characters but take three times the space. A passphrase pays in string length for being memorable.
The strength of a passphrase comes from the size of the word list and the number of words, not from how odd it sounds. A phrase a person invents from the same words is markedly weaker.
That caveat matters: a generator must pick the words. “My cat Tom likes fish” is not a passphrase but a sentence, and wordlist rules catch it.
How they differ in practice
| Property | Random password | Passphrase |
|---|---|---|
| Typing by hand | painful | easy, error-free |
| Reading out loud | nearly impossible | no clarifications needed |
| Memorising | no | yes, with repetition |
| Site length limits | always fits | often does not |
| Strength density | 6.5 bits per character | 1.8 bits per character |
The rule for choosing
- Typed by hand and often — take a passphrase: the master password of a manager, a laptop login, a disk unlock code.
- Lives in a manager and gets pasted — take a random password: ordinary sites, shops, social media.
- Typed with a TV remote or dictated — a passphrase, ideally without special characters.
- Supplied by a program — random and long: nobody will type it anyway.
Three common mistakes with passphrases
- Choosing the words yourself. People pick words related in meaning, and the search space collapses by orders of magnitude.
- Taking four words “to save time”. Forty-four bits is the level of an eight-character password — too little for email or banking. Six at minimum, seven is better.
- Removing the separators. “anchorbreezesealwax” reads worse and gains nothing: the strength is in the choice of words, not the hyphens.
How the bit count works and why filters such as “drop look-alikes” lower it is covered in the article on entropy.