What Is a Passphrase?

A passphrase is a password made of words

A passphrase is a secret built from several words instead of a short mix of symbols. For example, preorder-snooper-craving-enamel-revocable-regain is a passphrase of six words joined by hyphens.

Technically, a passphrase is still a password. NIST, the US standards body, says a password is "sometimes referred to as a passphrase" ^[1]. The difference is in how it is built: a passphrase gets its strength from the number of words and the size of the list they come from, not from unusual characters.

Here is how a random passphrase is built, one word at a time, and what four, five and six words are worth with the EFF large wordlist:

×

Each extra word multiplies the number of possible phrases by 7,776. The words in the picture were picked at random for this page, so they are public now: never use them.

Passwords vs passphrases

A typical random password draws characters from a set such as letters, digits and symbols. Example: q7#Vm2!xR9pL. Each character adds a little unpredictability, and the result is hard to remember.

A random passphrase draws whole words from a list. Each word adds more unpredictability than a single character, because the list is much larger than a character set. A list of 7,776 words gives about 12.9 bits per word ^[2]; one character from the 94 printable ASCII symbols gives about 6.6 bits.

Here, "bits of entropy" measures how many equally likely possibilities exist. Each extra bit doubles the number of guesses an attacker needs to try every option. See Password Entropy Explained for the full formula.

Side by side, for random passwords and random passphrases of similar strength:

Both are only as strong as the randomness behind them: a password you invent or words you choose yourself are far weaker than the numbers in this table.

The trade-off is length: a six-word EFF passphrase with hyphens averages about 47 characters, while a random 12-character password of similar strength is shorter but harder to remember. EFF's dice guide suggests a passphrase for things you unlock directly, such as full-disk encryption, and for the master password of a password manager ^[5]. For everything else, the manager can store a random password from our password generator.

Password ideas that are actually strong

When a site asks for a new password, the useful question is not "what sounds clever?" but "how many guesses would it take?". A good idea is one an attacker cannot predict, even if they know the method you used.

Ideas that fail

These ideas are popular, and that is the problem:

• Names and birthdays. Your name, a partner's name, a child's birthday or your own birth year. These are short, and details like these are often easy to find or guess.
• Pet names and favourite things. A dog's name, a football club or a band, often with a number added.
• Keyboard walks. Patterns such as qwerty, asdfgh or 1qaz2wsx follow the key layout, so they are among the first things attackers try.
• A common word plus a year and a symbol. Summer2026! looks complex, but it is a dictionary word, a year and the most common symbol at the end.
• Quotes, lyrics and famous phrases. A line from a song or film can be long and still weak, because it already exists in text that attackers can collect.

NIST explains why these fail. It notes that people respond to composition rules in predictable ways: someone who wanted "password" tends to type "Password1", or "Password1!" when a symbol is required ^[1]. For this reason NIST requires services to compare new passwords against a blocklist of "commonly used, expected, or compromised passwords", such as passwords from earlier breaches, dictionary words, and words linked to the service or the username ^[1].

A blocklist only catches what is already on it; a new password can still follow a pattern that guessing tools try early. Our Password Strength Checker flags names, dictionary words, keyboard patterns, dates and years inside a password.

The deeper reason is human. EFF's Joseph Bonneau notes that people are not very good at making random, unpredictable choices ^[2]. Even when we try to be original, we tend to pick similar words and similar substitutions, such as @ for a.

Ideas that work

Two ideas hold up because the randomness does not come from you:

1. Random words from dice or a generator. Roll dice with the EFF wordlist, or use a generator that picks words with a cryptographically secure random number generator. EFF recommends at least six words from its long list ^[4][5]. This is the best idea for the few passwords you must remember.
2. A random password stored in a password manager. For most accounts you never need to remember anything. Let the manager create and fill a long random password, different for every site. EFF suggests using your passphrase to protect the manager itself ^[5]. If you are unsure about trusting one, read Are Password Managers Safe?.

Use each secret for one purpose only. EFF warns that a passphrase leaked from one site can be tried on your other accounts ^[5].

Example passphrases (never reuse these)

These were generated for this page from the EFF large list, six words each, with Node.js crypto.randomInt:

• confess-turtle-superhero-composite-baggy-doorman
• enhance-secrecy-issue-tidbit-playset-ravage
• violet-rubbing-parka-unquote-justness-jokingly

They show the style only. Because they are published here, an attacker can add them to a list, so never use them, or any example you read online, as a real password. The same applies to preorder-snooper-craving-enamel-revocable-regain above. Make your own with dice or our Passphrase Generator.

Diceware: where random passphrases come from

Diceware is a method for making passphrases with ordinary dice. Arnold G. Reinhold first published it on Usenet in August 1995 ^[3]. His page credits Sigmund N. Porter with inventing modern passphrases in 1981 ^[3].

The method is simple. You roll five six-sided dice, read the result as a five-digit number such as 4 3 4 6 3, and look up that number in a list of 7,776 words. You repeat this once per word ^[3][5]. Because each word is picked by dice, nobody, including you, chooses it.

Reinhold advises physical dice and warns against computer programs or electronic dice whose randomness you cannot check ^[3]. Today a browser's cryptographically secure random number generator (CSPRNG) is the usual alternative: it is designed to produce values an attacker cannot predict. Our generator uses only crypto.getRandomValues() and refuses to run without it. Like any web tool, it is only as trustworthy as the code it delivers; the source is published on How It Works.

The EFF wordlists

In July 2016 the Electronic Frontier Foundation (EFF) published new wordlists for Diceware-style passphrases ^[2]. The large list has 7,776 words, made for five dice, and gives 12.9 bits per word ^[2]. EFF removed rare words, unusual names, vulgar words, homophones and words that are hard to spell, so the words are easier to type and remember ^[2]. No word in the large list is an exact prefix of another ^[2].

EFF also offers two short lists of 1,296 words each, made for four dice ^[2][4]. They give 10.3 bits per word ^[2], so you need more words for the same strength. EFF's current guide adds that lists of the same length give about the same strength; they differ mainly in how memorable the phrases are ^[5].

Our Passphrase Generator uses the EFF large list.

Why the words must be chosen at random

The strength of a passphrase depends on the process that picked the words, not on how the words look. If every word is chosen uniformly at random from 7,776 options, an attacker who knows the list and the method still has to search all combinations. As EFF puts it, measuring the security of a random passphrase "is easy" ^[2].

If you choose the words yourself, this calculation no longer holds, and the phrase can be far easier to guess than its length suggests.

The rule is short: the randomness must come from dice or a CSPRNG. You may reject a phrase you dislike and generate a new one, but do not edit words in or out by hand.

How many words do you need?

EFF's current Diceware guide (revised July 2025) recommends a minimum of six words from its long list, or from any other list of the same size, and adds that more words make the phrase stronger ^[5]. It gives the number of possible six-word phrases as 221,073,919,720,733,357,899,776, or about 2^77 ^[5]. Reinhold recommends six words as a minimum and seven to nine for high-value uses such as disk encryption ^[3].

With the EFF large list, each word adds about 12.9 bits:

These follow from H = L × log2(N), with L words and a list of N words.

As a worked estimate using this site's assumptions: at 10^11 guesses per second against a fast hash, the average time to find a six-word phrase (half of 7,776^6 guesses) is roughly 35,000 years. Against a slow hash such as bcrypt, it is far longer. These are estimates under stated assumptions, not guarantees. Try other values in the Password Entropy Calculator.

In our view, four words (about 52 bits) can be enough for a login protected by rate limits, but it is below EFF's recommendation and a weak choice for anything an attacker could test offline, such as an encrypted file.

Separators, capitals and digits

A separator is the character between words. Our generator offers a hyphen, space, dot, underscore, no separator, or a random digit.

A fixed separator such as - adds little or no entropy, because an attacker can simply try the few common choices. Capitalising the first letter of every word is the same: it is a fixed rule, so it does not add unpredictability.

A random digit separator is different. Each gap gets a new random digit from 0 to 9, adding about 3.3 bits (log2 10). Six words have five gaps, so the total rises from about 77.5 to about 94 bits, at the cost of a phrase that is harder to remember.

Memorability

Random words are easier to remember than random characters for many people, but they still take practice. EFF suggests making up a story, scenario or sentence that reminds you of the words in order ^[4][5]. For preorder snooper craving enamel, you might picture a snooper who preorders a snack he is craving and chips his tooth enamel. The story is for memory only; the words stay in their random order.

EFF notes that further study is needed to know which of its lists gives phrases that are easier to remember ^[2]. Type a new passphrase several times on the first day and keep a secure backup until you know it well.

Why modern password rules favour passphrases

NIST SP 800-63B Revision 4 sets a minimum of 15 characters for passwords used as the only factor, and says services SHOULD allow at least 64 characters ^[1]. It also says services SHALL NOT impose composition rules such as requiring a mix of character types, and SHOULD accept spaces so that people can use phrases ^[1]. See Password Requirements for the full length rules.

These rules make passphrases practical: a six-word phrase easily passes the 15-character minimum and fits within 64 characters, and a site should not reject it for having no digit or symbol. Not every service follows the current guidance, so you may still meet short limits or forced symbols.

Generate a passphrase

Generate a passphrase with our Passphrase Generator. It picks words from the EFF large list with crypto.getRandomValues() in your browser, shows the entropy for your settings, and does not send the result anywhere.