Passphrase vs Password?
'Tr0ub4dor&3' is hard to type and easy to forget; 'correct horse battery staple' is easy to remember and brutally hard to crack. Length beats cleverness in password math — four random words out-muscle most 'complex' passwords. Here is when a passphrase wins and how to build a good one.
TL;DR / Quick Fix
Quick fix: a passphrase is four or more random words — long, memorable, hard to crack. Pick truly random words (dice or a generator), never lyrics, and use a different one per important account. Passphrases shine where humans must memorize; a password manager's random string works fine everywhere else.
Follow these steps
- Learn why length wins. Every extra character multiplies the guessing work. Four random words carry more combinations than an 8-character 'complex' password — and you can actually remember them.
- Pick four or more truly random words. Use dice or a passphrase generator. Human-chosen words cluster around pets, foods, and song lyrics — exactly what attackers guess first. Randomness is the whole trick.
- Keep the words unrelated. 'guitar piano violin drums' is a category, not randomness. 'guitar stapler orbit mango' forces an attacker through the full word list.
- Do not reuse the passphrase. One passphrase per important account — reuse kills the advantage just as it does with passwords. See the reuse risk guide.
- Add a number or symbol only if required. Some sites demand complexity characters. Tacking '7!' on the end satisfies the checker without hurting memorability.
- Store it in a manager anyway. Even memorable passphrases belong in your password manager as backup. Memory fails; the vault does not — and it enables emergency access if you are ever locked out.
What NOT to do
- Do not use song lyrics, quotes, or proverbs. Attackers keep lists of them — a famous chorus is a terrible passphrase.
- Do not use fewer than four words. Three common words fall to modern guessing far faster than people expect.
- Do not 'improve' randomness with leetspeak. Swapping letters for numbers adds almost no strength and makes the phrase harder to remember.
- Do not share the method as the secret. Telling someone 'I use four words' is fine — the words themselves are the secret.
Frequently asked questions
Are passphrases really stronger than complex passwords?
Usually yes. A four-word random passphrase has far more combinations than an 8-character mixed password, and you will not write it on a sticky note.
How do I pick the random words?
Roll dice against a word list or use a reputable passphrase generator. The key is that you did not choose words with personal meaning.
Should I still use a password manager with passphrases?
Yes. Use passphrases for the few passwords you type daily — like the manager's master password — and let the manager generate random strings for everything else.