Why a Passphrase Beats a Password

The password advice we all got was half wrong

For years we were told a strong password meant a short jumble of letters, numbers, and symbols. Something like "P@ssw0rd!". It turns out that advice was backwards. Those passwords are hard for people to remember and, for a computer trying to crack them, not as strong as you'd think.

There's a better approach, and it's easier: the passphrase.

What a passphrase is

A passphrase is several random words strung together instead of a short scramble of characters. Something like "copper-antelope-village-lantern."

It looks almost too simple, but it's both easier for you to remember and much harder to crack. The reason is length. Each extra word multiplies how many combinations an attacker has to work through, far more than swapping an "a" for an "@" ever does. Length beats complexity.

The one rule that matters: make it random

A passphrase only works if the words are random and unrelated. This is where people slip:

• Don't use a phrase from a song, movie, or common saying. "tobeornottobe" is long and still weak, because it's guessable.
• Don't use words that connect. "red-blue-green-yellow" or "monday-tuesday-wednesday" are patterns, and patterns get guessed.
• Do pick words with nothing to do with each other. The more unrelated and surprising, the stronger.

A good trick is to let a password manager generate the passphrase for you, so the randomness is real.

Where this fits with the rest

A passphrase works alongside the other basics:

• Use a different one for each important account. Reusing even a great passphrase everywhere means one breach unlocks everything.
• Let a password manager remember them. Then the passphrase you actually have to memorize is just the one that unlocks the manager itself, and that one should be a long, strong passphrase.
• Turn on two-factor authentication wherever it's offered, as a second layer.