Strong Passwords vs Passphrases: Which Should You Use?

Advice about passwords has flipped several times. Mix in symbols; no, use long words; change every 90 days; no, stop changing them. The confusion is understandable. This post cuts through it with the one idea underneath all of it: how many guesses would an attacker need? Then it applies that to random passwords and passphrases, including honest numbers for the generators on this site.

What makes a secret hard to guess

Security people measure this in bits of entropy. Each bit doubles the number of guesses. A secret with 40 bits has about a trillion possibilities; 80 bits has a trillion times more.

For a randomly chosen secret, the arithmetic is simple. If each choice comes from a pool of N options, one choice adds log2(N) bits. Choose k times independently and the bits add up.

• A random lowercase letter: about 4.7 bits.
• A random character from 88 symbols, letters and digits: about 6.5 bits.
• A random word from a 7,776-word list: about 12.9 bits.

The word randomly carries all the weight. Entropy figures describe the generator, not the result. A password you invented, like Summer2024!, may look complex but sits in a tiny set of patterns that attackers try first.

Random passwords

A random password of 16 characters drawn from all four character types gives roughly 103 bits in this tool's case: the pool is 26 lowercase, 26 uppercase, 10 digits and 26 symbols, which is 88 characters, and 16 times 6.46 is about 103. That is far beyond what anyone can brute force.

The catch is memory. Nobody remembers k#4Qv!9tZp2$Lm7x, and you should not try. Random passwords are for accounts where a password manager fills the field.

Passphrases

A passphrase is several words in a row. The famous example is four unrelated words. It works because the human brain handles pictures and phrases much better than random characters, and because length is what raises entropy.

The strength depends entirely on the word list size and on randomness. Four words from a list of 7,776 give about 52 bits. Six give about 77. Words must be picked by dice or software, not by you. People choose predictable words and orders, and attackers' dictionaries model that.

Use a passphrase for the few secrets you must type from memory: your device login and the master password of a password manager.

An honest look at the MergeDoc generators

The Passphrase Generator draws words with the browser's secure random source, and lets you pick 3 to 8 words and a separator (hyphen, space, underscore or dot). But its built-in word list is short, about 93 distinct words. That is only about 6.5 bits per word:

• 4 words: roughly 26 bits.
• 6 words: roughly 39 bits.
• 8 words: roughly 52 bits.

Those are modest numbers. They are adequate for low-stakes uses like naming a temporary share, and weak for anything an attacker can test offline against a stolen hash. The Password Generator, which draws every character from a pool of up to 88 symbols, is the stronger option here: 16 characters is about 103 bits.

If you want a memorable high-entropy passphrase, roll physical dice against a 7,776-word list (the EFF and original diceware lists are public) and use six or more words. For daily logins, let a password manager generate and store the secret.

How to generate a strong password here

1. Open the Password Generator.
2. Move the Length slider (8 to 32). For stored passwords choose 16 or higher.
3. Keep lowercase, uppercase, digits and symbols ticked. Untick symbols only when a site rejects them, and then add length.
4. Click Generate password, then Copy.
5. Paste straight into your password manager or the sign-up form. Do not save it in a text file.

How to use the strength checker properly

The lower section of the same page scores a password you type. It is a heuristic: points for length of 8 and 12 or more, for using three or more character types, and for 16 or more characters with all four. It cannot recognise dictionary words, keyboard patterns or leaked passwords.

Two examples show the limit. correct horse battery staple scores only "Fair" because it is all lowercase, even though a randomly chosen four-word phrase from a big list is decent. Meanwhile Aa1!Aa1!Aa1!Aa1! scores "Very strong" although it is a repeating pattern an attacker would guess quickly. Use the meter to spot obviously weak passwords, not to certify strong ones.

Where current tools fall short

Plenty of generators send requests to a server or load heavy scripts, which is exactly the wrong place for a secret. Many strength meters make confident claims from simple rules, and some websites enforce confusing rules (one symbol but not these symbols, maximum length 12) that push people toward weaker choices. Free generators attached to marketing funnels may ask for an email first.

This site's tools run in the tab with no account. The limits are the ones above: a small passphrase word list and a heuristic meter. They are tools for convenience, not a replacement for a password manager and two-factor authentication.

Everyday use cases

• New account sign-up. Generate 20 random characters and store them in your manager.
• Wi-Fi passwords for guests. A memorable three or four-word phrase is easy to read out, and low stakes.
• Protecting a PDF. A long unique password for Protect PDF works better than a birthday.
• Shared accounts. Create a strong password once and share it through a secure channel.
• Auditing old habits. Test whether your reused favourite passes even a basic length check.

Choosing by situation

Rather than ask which style is best, ask what the secret protects and where it lives.

Stored in a password manager, used on a website. Use a long random password. You never type it by hand, so memorability is irrelevant. Sixteen to twenty random characters is plenty. The manager also protects you against fake sites by filling only on the right domain.

Typed from memory on a device. Use a passphrase of at least five or six random words from a large list, plus a separator you like. You will type it many times a day, so choose something your fingers can learn.

The master secret for the manager itself. This is the one passphrase worth memorising well. Generate it randomly, write it down on paper once, keep the paper somewhere physically safe, and destroy it after you are certain you remember it.

A file or archive that someone else must open. Use a long random password and send it over a different channel from the file. Whether it is a PDF or an encrypted text, the weakest link is usually how the password is shared, not the encryption itself.

A temporary, low-stakes share. A short generated phrase is fine, as long as it is not reused anywhere.

In every case the same two rules apply: it must be unique to that one use, and chosen by a random process, not by you. Add two-factor authentication on top for anything that matters.

Tips and mistakes to avoid

• Never reuse passwords. One breach then unlocks everything else.
• Prefer length over cleverness. Substituting @ for a barely helps.
• Do not build a passphrase from a quote or lyric. They are in attackers' dictionaries.
• Turn on two-factor authentication wherever it exists.
• Clear your clipboard after copying on a shared machine.
• Learn how sites store passwords. If you build one, read SHA-256 hash explained to see why plain hashes are not enough.

Related reading

To lock documents with your new password, read the password protect PDF guide. For encrypting text with a passphrase, see AES-256 text encryption explained. Browse the full set in security tools.