Passphrase vs password: which should you use?
Both can be strong. The right one depends on who has to type it — you, or your password manager.
On this page
The short answer. Use a random password wherever a password manager fills it in for you. Use a passphrase when you’ll type it by hand — a TV, a games console, the master password for the manager itself.
What each one is
A random password is a string of characters picked one at a time from a pool — letters, digits, symbols: qT7#vL2m!Rw9xK4p. A passphrase is a few words picked at random from a long list: orbit lamp cedar velvet quarry pilot.
The word “random” matters in both. Words you choose yourself, or a line from a song, are far easier to guess than they feel.
How strong each one is
For random characters strength is log₂(pool) × length; for words it’s log₂(list size) × words. Rather than a table, move the sliders and compare them on the same scale:
51.4 bits · Fair · 0 characters to type
77.7 bits · Strong · 12 characters to type
The characters are stronger here by 26 bits. (Sample words from a short built-in list until the full list loads.) Words from the EFF long list (379 words); characters from all 89. Estimates assume 100 billion guesses a second.
When a passphrase wins
- The master password for your password manager — the one thing you must remember.
- Anything typed on a TV remote, console controller or someone else’s device.
- Wi-Fi passwords you read out to guests.
- Device or disk encryption you unlock by hand.
When a random password wins
- Every account your password manager fills in — you never type it, so length is free.
- Sites with a short maximum length, where every character must carry as much as possible.
Mistakes to avoid. Picking the words yourself, using quotes or lyrics, settling for three or four words, or reusing a passphrase anywhere else.
Questions
Should I add a number or symbol to a passphrase?
Only if a site insists. One forced symbol adds very little; an extra word adds much more.
Does the separator matter?
Not for strength — assume an attacker knows it. Pick whatever is easiest to type.
How many words are enough?
Six from a large list is a good default; seven for the password that guards all the others.
Try it: a 6-word passphrase
Opens the generator on Build your own → Words.