What is a passphrase, and when is it better?

Words trade density for memory. Whether that is a good trade depends on whether you have to type it.

Passwords Published October 20, 2026 2 min read

The arithmetic

A passphrase draws words independently from a known list. With the EFF large list of 7,776 words, each word contributes log2(7776) ≈ 12.93 bits. Four words is about 52 bits; six words is about 78.

That is less than a 16-character random password (about 103 bits) — but a passphrase is memorable and a random string is not, and a password you have to look up is a password that ends up written on a sticky note.

Why the word list size is the whole claim

A generator that does not disclose its list size cannot be evaluated. The difference between a 1,000-word list and the EFF list is a factor of 4,000 in search space for the same four words on screen.

List size	Bits per word	4-word total
1,000 words	9.97	40 bits
2,048 words	11.00	44 bits
7,776 words (EFF)	12.93	52 bits
20,000 words	14.29	57 bits

When a passphrase is the right choice

When a password manager can hold the value, a random string is denser and strictly better. The passphrase exists for the cases where the manager is not reachable.

A password manager master password — you must remember it and type it often.
Full-disk encryption — entered before any manager is available.
Device passcodes on TVs, consoles and streaming boxes, where symbol input is painful.
Anything you will type by hand on a device without a clipboard.

Frequently asked questions

Are passphrases easier to crack than passwords?

Per character, yes. Per unit of memory, no. Six random words is about 78 bits and you can remember it; a 78-bit random string is 12 characters of noise.

Should I use a phrase I invented?

No. Invented phrases follow grammar and idiom, which an attacker can model with a language model. Independent random selection is what makes the entropy figure real.

How many words should a master password have?

Six. It protects everything else, and it is the one password where the extra typing is worth it.

Tools that go with this guide

Passphrase Generator Words instead of symbols, because you might actually have to type this one. Random Passphrase Generator Independent word selection, so knowing one word tells you nothing about the next. Password Strength Checker Type a password and see the bits, the estimated crack time and what is wrong with it. Password Generator Create a random password with the length and character sets you need. Everything runs locally.

More guides

Passwords How long does it take to crack a password? The answer depends almost entirely on two things: how the password is stored, and how long it is. Passwords What actually makes a password strong Four properties matter. Most of the advice people repeat is about the least important one. Passwords Password generator vs password manager: which do you need? They solve different halves of the same problem, and using one without the other barely helps. QR codes Why won't my QR code scan? Almost every failed scan comes down to one of eight causes. Here is how to tell which.