Passphrase vs Random Password: Which to Use

What the current NIST standard says (and what changed)

NIST SP 800-63B-4, the US government's authentication guideline that many organizations use as a reference, sets out several rules about passwords in writing. The most relevant ones here: a password used as the only authentication factor must be at least 15 characters long (if it is only part of a multi-factor authentication, the minimum drops to 8); systems should allow lengths of at least 64 characters; and they must NOT impose composition rules, such as requiring a mix of uppercase, numbers and symbols, nor force periodic changes unless there is evidence the password has been compromised.

The underlying change is one of emphasis: the standard puts length ahead of apparent complexity. The practical reason is that composition rules push people toward predictable patterns ("Password1!"), whereas a longer password raises the search space without being harder to remember. That is exactly what makes a multi-word passphrase attractive.

How strength is measured: entropy in bits

Entropy in bits summarizes how many combinations an attacker would have to try: each extra bit doubles the search space. For a random-character password, each character contributes log₂(N) bits, where N is the alphabet size: with the 94 printable characters that is ≈6.55 bits per character. For a passphrase, each word chosen at random from a list of 7,776 words (EFF's long wordlist for Diceware, designed to be rolled with five dice) contributes log₂(7776) ≈ 12.9 bits per word.

The table below compares both under the same assumptions as the password-cracking-time guide: a single high-end GPU, 1.6 × 10¹¹ guesses per second against a fast hash and about 1.7 × 10³ against bcrypt at cost 12. These are times to run through the whole space (the worst case); on average, half.

What the comparison shows

A 6-word random passphrase (77.5 bits) is practically equal in strength to a 12-character random password (78.7 bits). The difference is that the phrase is memorable and reasonably easy to type, and the character string is not. A 4-word passphrase, on the other hand, equals only an 8-character random password: against a fast hash it falls in a matter of hours. That is why 4 words is considered the lower bound and 6 a safer figure for anything important.

There is also an upper limit to what makes sense: 16 random characters give 104.9 bits, far more than needed to resist a realistic attack even with dedicated hardware. Past a certain point, making it longer does not protect you from the risks that matter: the site storing your password badly, you reusing it, or it being stolen through phishing or malware.

The mistake that invalidates a passphrase's strength

The figures in the table only hold if the words were chosen at random from a known list, for example by rolling dice. A phrase that "sounds random" but that you made up ("my dog eats blue cookies") does not have 12.9 bits per word: humans pick common words, related to one another, with natural syntax, and an attacker who models phrases instead of characters tries them much sooner. The same applies to a famous quote, a song lyric or a proverb, which are in dictionary lists.

Two practical rules: do not modify the generated phrase to make it "look stronger" (swapping letters for symbols adds almost nothing and makes it harder to remember) and do not pick the words yourself. If you want word-based phrases, use the EFF list with real dice or a password manager that offers passphrase generation from a cryptographic source.

Which to use in each case

For the vast majority of your accounts, the answer is a random-character password, unique per service, stored in a password manager. You do not need to remember it, so length and randomness cost nothing; 16 characters or more is a comfortable value. You can generate it with this site's password generator, which builds each character with crypto.getRandomValues() in your browser.

A multi-word passphrase is the best option for what you DO have to remember and type unaided: the password manager's master password, your computer login, a disk encryption passphrase. There, a 6-word random passphrase gives strength equivalent to a long password and is much easier to memorize. In both cases, turn on two-step verification wherever it exists: no password, however long, protects you from handing it over on a fake page.

Frequently asked questions

How many words should a secure passphrase have?

With words chosen at random from a list of 7,776 (like EFF's Diceware list), 4 words give about 51.7 bits, which fall in hours against a fast hash. 5 words (64.6 bits) is a reasonable minimum and 6 (77.5 bits) is safer for important accounts.

What minimum length does NIST require for a password?

The NIST SP 800-63B-4 text requires a minimum of 15 characters when the password is the only authentication factor, and allows 8 when it is only part of a multi-factor authentication. It also says systems must not impose composition rules or mandatory periodic changes.

Is a phrase with symbols and numbers stronger?

Hardly. Swapping letters for symbols in the usual way ("a" for "@") is a pattern attackers already include in their rules. Adding one more random word contributes much more: each word adds about 12.9 bits.

Can I use a famous phrase or a song lyric?

No. Well-known phrases, proverbs and lyrics are in dictionary lists, and an attacker tries them long before truly random combinations, no matter how many characters they have.

Do I still need a passphrase if I use a password manager?

For accounts stored in the manager, no: use long random characters. You do need a memorable passphrase for the manager's own master password and for anything you must type without it, such as your computer login.