Passphrase vs password: which should you use?
Both can be equally strong. The difference is who has to remember and type them.
Same strength, different shapes
| Option | Example shape | Entropy (bits) |
|---|---|---|
| 6 random words | Lance-Quiver-Dimple-Shrank-Basil-Unify | 77.5 |
| 12 random characters, all types | q7#Vt9mR!xP2 | 77.3 |
| 7 random words | seven words | 90.5 |
| 16 random characters, all types | sixteen characters | 103.1 |
Six words from the EFF list match a 12 character random password. The passphrase is longer but far easier to type on a phone and to remember.
Use a passphrase for
- Your password manager's master password.
- Your computer or phone login, if it is a password rather than a PIN.
- Anything you type often or must remember, such as a work login.
- Wi-Fi guest networks you read out to people.
Use a random password for
- Every account stored in a password manager, which fills it in for you.
- Sites with a length cap, where characters must carry more entropy each.
- Machine secrets and API keys, where a random string is the norm.
The one rule for both
Let a generator choose. A passphrase you made up from words that mean something to you is far weaker than random words, and a "random" password typed by mashing keys has patterns. Strength comes from the random choice, not the look of the result.
Sources
- EFF Dice-Generated Passphrases and the long wordlist, Electronic Frontier Foundation. Checked 18 October 2026.
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.
Related tools and guides
Passphrase generatorRandom words you can remember and type.Password generatorFree password generator that runs in your browser. Strong, random passwords and passphrases made with the Web Crypto API. Nothing is sent or stored.How long should a password be?The numbers behind 12, 15 and 16 characters.Strength checkerTest a password and check it against known breaches.