What Is a Passphrase? | How to Make a Password You Can Remember and Attackers Can’t Crack

A passphrase makes a secret strong through length

A passphrase is a long secret made by joining several words. Instead of keeping it short and mixing in symbols, you string together randomly chosen words you can remember to build up length. The time needed for a brute-force attack multiplies with every extra character, so length is the more efficient way to add strength.

Notice that six words are about as strong as 12 random letters, digits and symbols. One you can remember; the other you can’t. Whether you can remember it matters a great deal in practice: passwords people can’t remember end up on sticky notes or reused on other sites.

How to make a passphrase

1. 1

   Pick 4–6 words at random

   Draw them from a dictionary or an app’s word list using dice or a random number generator. If you pick “six words you like”, they skew toward your hobbies and work and become easier to guess.

2. 2

   Make sure the words don’t connect

   If they form a phrase, like “blue sky pretty”, draw again. Unrelated words are stronger and, surprisingly, easier to remember.

3. 3

   Decide how to join them

   Join them with hyphens or periods, or capitalize the first letter of each word. Separators make typos less likely. This choice adds little strength, so prioritize ease of typing.

4. 4

   Fit the site’s restrictions

   Sites with rules like “symbols required” or “16 characters max” won’t accept a passphrase. In those cases, switch to a random string as described in the next section.

5. 5

   Keep it written down nearby for a few days

   For the few days it takes to memorize, write it on paper and keep it out of sight. In many situations, getting locked out and having to reset is a bigger risk than a short-lived note.

If you build one from words in a language that uses accented letters or a non-Latin script, first check whether the service accepts those characters. Some screens can’t take anything but basic keyboard input (such as start-up disk encryption or BIOS), so for anything that unlocks a device, plain unaccented Latin letters are safer.

Where passphrases fit, and where they don’t

Not every password needs to be a passphrase. The realistic approach is to use passphrases only for what you have to keep in your head and to leave the rest to a password manager.

For shared accounts, the issue isn’t memorability but how you hand it over. Ways to share without pasting into email or chat are covered in how to share passwords safely.

Random strings for individual sites can be made with the password generator tool. You can choose a length from 4 to 64 characters and turn upper case, lower case, digits and symbols on or off individually, so you can meet site restrictions like “no symbols” or “12 characters max”. Generate several candidates, pick one that’s easy to type and save it straight into your password manager. The assumption is that you don’t try to memorize generated strings.

Common mistakes

• Using proverbs, song lyrics or movie lines. Famous phrases are already in attackers’ dictionaries, so they fall instantly no matter how long they are.
• Swapping letters for symbols (a for @, o for 0 and so on). These substitutions are built into attack tools and add almost no strength.
• Adding digits and a symbol at the end to meet the rules. The “Password1!” pattern is among the first to be tried.
• Using the same passphrase on several services. If one leaks, the same combination is tried elsewhere.
• Cutting the number of words and making up for it with symbols. Going below four words throws away the advantage you gained from length.

The danger of reuse exists regardless of how strong your password is. However long it is, it doesn’t help if the breached service stored it in plain text. You can check whether your address appears in leaked lists with how to check for password leaks.

Regular password changes are no longer recommended

Changing passwords every 90 days was standard practice for a long time. Current major guidelines no longer recommend periodic changes. When people are forced to change, they adopt easy-to-remember patterns and make small changes (such as incrementing a trailing number), which actually makes passwords easier to guess.

• Change it when there are signs of a leak. That is the most effective time.
• If a service notifies you of a breach, change that password and every other place you reused it.
• Change it when something changes on the human side, such as losing a device or a change in your relationship with someone you shared it with.
• Rather than changing on a schedule, creating one long password, keeping it and adding two-factor authentication is safer.

Once you have settled how to create passwords, storage is what remains. Memorizing only one master passphrase and putting everything else in a password manager is the setup least likely to break down. Setup steps are in how to use a password manager.

FAQ

What is the difference between a passphrase and a password?

They work the same way; the difference is in how you create them. Passwords are often short with mixed character types, while passphrases get their strength from length by joining several randomly chosen words. Brute-force time multiplies with each extra character, so length adds strength more efficiently. Six random words are about as strong as 12 random letters, digits and symbols, and you can actually remember them.

How many words does a passphrase need?

Four randomly chosen words is the minimum, and six is enough for now. Four words are about as strong as 8 random letters, digits and symbols, and six about as strong as 12. That assumes the words are drawn at random from a dictionary or with random numbers; words you think up yourself lean toward meaningful connections and are weaker than expected. Avoid cutting words and adding symbols instead, as that throws away the advantage of length.

Can I use a proverb or my favorite lyrics as a passphrase?

Please don’t. They may be long, but famous sentences and phrases are already in attackers’ dictionaries. Assume lyrics, movie lines, passages from books and proverbs are all included. Tricks like swapping letters for symbols (a for @, o for 0) are also built into attack tools along with the substitution rules, so they add almost no strength. Random, unrelated words are safer.

Should I change my passwords regularly?

Scheduled changes are not recommended by current major guidelines. Forcing changes leads to predictable patterns, such as incrementing a trailing number, which makes passwords weaker. Change them when there is a concrete sign: a breach notification, your address appearing in a leaked list, or a lost device. The rest of the time, creating one long password, keeping it and adding two-factor authentication is more effective.