Why length matters more than complexity
For years, people were told to build passwords like P@55w0rd!: a short mix of capitals, digits and symbols. These are hard for humans to remember and, surprisingly, not that hard for software to guess. Attackers know the usual tricks, such as swapping an “a” for “@” or adding “1!” at the end.
A passphrase takes a different approach. Instead of a short, tangled string, you use several words in a row. Every extra character multiplies the number of possible combinations, so a long passphrase can be both easier to recall and harder to guess. The key is that the words are chosen without a pattern the attacker can predict.
What makes a good passphrase
A strong passphrase usually has these qualities:
- Length. Four or more unrelated words is a common starting point. Five or six is better for something important.
- Randomness. The words are chosen by chance, not because they mean something to you.
- Uniqueness. It is used for one purpose only.
- Memorability. You can picture it, say it aloud, and type it without effort.
Randomness is the part people skip. If you pick the words yourself, you will tend to choose related words, such as your pet’s name and your street. Humans are poor at being random, and attackers can try personal guesses first.
A simple way to build one
You can generate a random phrase without any special software.
- Choose a random source. One method is rolling physical dice to pick words from a published word list designed for the purpose. Many password managers also include a passphrase generator that does the same thing.
- Pick four to six words. Accept what the generator gives you. Rerolling until you like it weakens the result.
- Join them. Use spaces or hyphens. Adding a capital or a number is optional; length is what is doing the work.
- Make it stick. Invent a short, slightly silly image that links the words in order, such as a giant spoon sitting on a bicycle near a lighthouse. Vivid images are easier to remember than lists.
- Practice. Type it from memory a few times over the first few days, then once or twice a week. Memory fades without use.
Mistakes to avoid
Some phrases look long but are weak.
- Famous lines. Song lyrics, film quotes, proverbs and book openings are in the lists attackers try.
- Personal facts. Names, birthdays, addresses, favorite teams and anything visible on your social media. Be mindful of oversharing risks, since small details posted publicly can be used as guesses.
- Predictable patterns. Keyboard runs like “qwertyuiop” or the same word repeated.
- Simple substitutions. Turning “pass” into “p4ss” adds little.
- Reuse. One strong passphrase used on ten sites is still a single point of failure. The danger is explained in the article on password reuse.
Where passphrases fit best
You do not need a memorable phrase for every account. In fact, the best arrangement for most people is:
- A password manager that creates long random passwords for most accounts, so you never have to remember them.
- A handful of passphrases you actually memorize: the one that unlocks the manager, your device passcode if it allows a long one, and perhaps your main email account.
That small list of memorized items is where a passphrase earns its place. Everything else can be generated and stored.
For a phone or laptop, a good lock matters too; the comparison of phone screen locks explains how a PIN, a pattern and biometrics differ. A long device passphrase is generally stronger than a short PIN, but it can be tedious to type many times a day, so many people use a shorter code on the screen and a long passphrase on the manager.
A note on the sites that make it hard
Some websites still force strange rules: a maximum length, a required symbol, or no spaces. If a site limits you, use the longest option it permits and add whatever it demands, such as one digit and one symbol at the end. If there is a hard cap that is oddly short, it is a reason to use a second step and not reuse that phrase anywhere else.
If you think your passphrase is known
Change it straight away on the affected account and anywhere else you may have used it. If you see signs that someone has gained access, work through the steps in hacked account response. Switching the passphrase is not enough on its own if the person also has access to your email, so check that first.
Keeping it written down, safely
It is acceptable to write a master passphrase down for a short time while you learn it, as long as the paper is kept somewhere safe, away from your devices, and without a label saying what it unlocks. Destroy it once you can reliably recall it. Some people keep a sealed copy with important papers in case of emergency, which can also help with digital legacy planning.
A good passphrase is not clever. It is long, random and yours alone, and a little repetition makes it as natural to type as your own address.