Why length beats complexity
For years, people were told to build passwords like Tr0ub4dor&3: a short word with capital letters, digits and symbols swapped in. Those passwords are hard to remember and, because people follow predictable patterns (a capital first letter, a number at the end), not as hard to guess as they look.
Attackers who guess passwords usually try common words, known leaked passwords and common substitutions first. Each extra character in a truly random string multiplies the number of possibilities, so length gives a large advantage. A passphrase is simply a password made of several words, which makes it long without being hard to recall.
The key ingredient is randomness
The strength of a passphrase comes from how unpredictable it is, not from how many words it has. A famous quote, a song lyric or a line from a book is long but guessable, because attackers can try well-known phrases. The same goes for anything personal, such as a pet’s name plus your street.
Words picked at random are the safest choice. As an illustration, if a word list has 7,776 entries (the size used by some dice-based methods), choosing four words at random gives 7,776 to the fourth power, which is more than three quadrillion possible combinations. Six words gives vastly more. Real-world protection also depends on how the service stores passwords and whether attackers can guess endlessly, so treat that figure as a way to compare options rather than a promise.
How to build one
- Pick the words randomly. Use dice with a published word list, or a reputable random generator, rather than choosing words that “feel” random. People’s choices tend to be less random than they think.
- Use at least four words, and more for important accounts. Five or six words is a reasonable choice for something like a password manager’s main password.
- Keep them unrelated. A phrase that forms a sensible sentence or a common saying is easier to guess than four words with no connection.
- Separate them as you like. Spaces, hyphens or nothing at all all work. Symbols and numbers are optional; some sites require them, in which case add them in a place that is not obvious.
- Make it a story. To remember a random set such as “lantern, orbit, tomato, canyon,” picture a vivid scene linking them in order. Repeat it a few times over a couple of days, then type it from memory.
Do not use the example words above for real; anything printed in an article should be treated as public.
Where passphrases fit best
You only need to memorize a handful of secrets:
- The main password for a password manager
- The sign-in for your primary email account
- The password that unlocks your computer or phone, if you use one
Everything else can be a long random string generated and stored by a password manager. A passphrase is for the passwords that must live in your head.
Mistakes to avoid
- Reusing a passphrase across accounts. A great passphrase leaked from one site still opens every other account that shares it, which is the heart of why reusing passwords is risky.
- Using personal facts. Birthdays, names, hometowns and favorite teams can often be found on social profiles.
- Writing it in an obvious place. A note stuck to the monitor defeats the purpose. If you must write one down, keep it somewhere physically secure, such as a locked drawer or safe, and not labeled.
- Using only a quote or lyric. Public text is the first thing a determined guesser tries.
- Sharing it by text or email. Anyone who sees the message sees the passphrase.
Adding a second layer
Even a strong passphrase can be stolen by a fake login page or by malware, so pair it with two-factor authentication wherever it is available. A strong passphrase plus a second proof of identity covers situations where either one alone would fail. Where a site offers passkey login, that can remove the typed password entirely for that account.
Change a passphrase if you suspect it was exposed, for example after a breach notice or after typing it on a device you do not trust. Otherwise, there is generally no need to change a strong, unique passphrase on a fixed schedule, though your workplace may have its own rules.
A quick way to check yourself
Before you commit to a new passphrase, ask four questions. Is it made of words chosen randomly? Is it long, with at least four words? Have I never used it anywhere else? Can I picture the story that helps me recall it? If the answer to all four is yes, you have a solid passphrase for the accounts that matter most. No password method can guarantee safety, but a long, random and unique phrase removes the most common weaknesses.