How many words should a passphrase have?

Six words is the usual advice and gives about 77 bits of entropy. Four or five is reasonable where guesses are limited, such as a device unlock or the passphrase on a one-time link. For a password manager master password or disk encryption, use seven or eight. Each word adds about 12.9 bits.

Is a passphrase more secure than a password?

Neither is more secure by nature: strength depends on how many possibilities it came from. Six random words and twelve random characters are roughly equal. The passphrase is far easier to type, remember and read aloud, while the password is more compact, which suits credentials that a machine stores.

Can I make up my own passphrase?

It is better not to. Phrases people choose come from somewhere, such as song lyrics, quotations, sayings and names, and cracking tools carry huge lists of exactly those. The strength of a passphrase comes from each word being drawn at random, which a person choosing words cannot do.

A method for picking passphrase words with ordinary dice. A list holds 7,776 words, which is six to the power five, so five dice rolls select one word with every word equally likely. The EFF wordlist was built for it. A generator does the same thing with the cryptographic random number generator in your browser instead of dice.

Do capital letters and numbers make a passphrase stronger?

Barely. Assuming an attacker knows your settings, capitalising each word adds nothing and a single digit adds about 3.3 bits. They exist to get past rules that demand them. An extra word adds about 12.9 bits, nearly four times as much.

Should my password manager master password be a passphrase?

Yes, this is one of the best uses for one. It is the password you type most often and cannot look up, so it has to be memorable and long. Seven random words gives about 90 bits and is quick to type once your fingers know it.

What is a passphrase, and how many words does it need?

A passphrase is several words chosen at random, joined together. The word "phrase" is a little misleading, because the strength comes from the words having nothing to do with each other. A sentence you think of is weak. Words picked by chance are strong, and they stay easy to type, say and remember.

Random words, not a phrase you choose

"My dog loves the beach" is long, and it is still a poor passphrase. Sentences people choose come from the same places: song lyrics, quotations, film lines, sayings, names and dates. Cracking tools carry enormous lists of exactly these, along with the obvious variations on each.

Words drawn at random give an attacker nothing to start from. Each word is an independent choice from a known list, so the only way to find the passphrase is to try combinations, and the number of combinations grows very quickly with every word added.

Where the words come from

Our passphrase generator uses the large wordlist published by the Electronic Frontier Foundation. It has 7,776 words of three to nine letters, picked to be familiar and easy to spell, with offensive and easily confused words removed.

The size is not an accident. 7,776 is six to the power five, so five rolls of an ordinary die pick one word with every word equally likely. That is the Diceware method, and it means a passphrase can be made with nothing but dice and a printed list. The generator does the same thing with the cryptographic random number generator in your browser, and the list is part of the page, so nothing is fetched or sent when you generate.

Every word adds the base-2 logarithm of 7,776, which is about 12.9 bits of entropy.

How many words you need

Four words, about 52 bits. Fine where guesses are limited, such as a device unlock or the passphrase protecting a one-time link.
Five words, about 65 bits. A good everyday choice for things typed often.
Six words, about 77 bits. The default, and about as strong as a twelve-character random password.
Seven words, about 90 bits. A password manager master password.
Eight words, about 103 bits. Anything that could be attacked offline for years, such as disk encryption.

Adding a word is the only setting that moves the strength much, so when in doubt, add one.

Capitals, numbers and separators

The strength figure the generator shows assumes the attacker knows your settings, because hoping they do not is not a security measure. On that basis capitalising each word adds nothing, a separator adds nothing, and a single digit adds about 3.3 bits.

They are there for systems with rules. If a site demands a capital letter and a number, switch them on and the passphrase gets through. If it does not, leave them off and enjoy a passphrase you can type without thinking.

The separator is about convenience. A hyphen is the default and works everywhere. A space is the easiest to type, but some systems trim or reject spaces. A full stop or an underscore are there for systems that dislike hyphens.

When a passphrase beats a password

For the same strength, a passphrase is longer to look at but far quicker for a person to handle. It wins wherever a human is involved:

Typed by hand, on a television, a games console or a new phone, where a random string of symbols means hunting across an on-screen keyboard.
Read aloud, to a colleague or a support line, where "correct horse" is unambiguous and "capital I, lowercase l, one" is not.
Remembered, for the handful of passwords you cannot look up, such as your laptop login and your password manager itself.

A random password is still the better choice when a machine stores it: entries in a password manager, values in a config file, and API credentials. There, compactness wins and nobody has to read it. The guide to strong passwords covers those.

Using a passphrase to protect a shared secret

When you share a secret through OOBSecret, you can require a passphrase before it opens. This is where four or five random words fit perfectly: strong enough for the job, and easy for the recipient to type.

The rule that makes it work is to send the passphrase by a different route from the link. If the link goes by email, read the words out on a call. Someone who intercepts the email then has a link that will not open, which is the point of out-of-band delivery.