Guide
What is a passphrase?
Summary. A passphrase is a password made of several random words. It gives you length that you can remember. Five words picked at random from our list of 7,776 give 64.6 bits, even if an attacker knows the list. The words must be random: a line from a song is not a passphrase.
1Passphrase vs password
Canada's Get Cyber Safe calls a passphrase "a memorized phrase consisting of mixed words with or without spaces", and recommends one because it is longer yet easier to remember than a password of random, mixed characters [1]. New Zealand's Own Your Online also says passphrases are easier to remember [2].
Example from our generator: catalyst-footrest-fossil-vitally-absolve. Do not use that one, because it is now on a web page.
2How many words do you need?
Each word picked at random from a list of 7,776 adds about 12.9 bits. The figure in Table 1 assumes the attacker knows the list and the method, and holds a stolen file with a fast hash at 10 billion guesses a second. That is one example rate. Real rates differ a lot, in both directions.
| Words | Bits | To try them all at 10 billion a second |
|---|---|---|
| 4 | 51.7 | 4 days |
| 5 | 64.6 | 90 years |
| 6 | 77.5 | over 100 years |
| 7 | 90.5 | over 100 years |
| 8 | 103.4 | over 100 years |
Bits = words × log₂ 7,776. Time = 2 to the power of the bits, divided by 10 billion, in years of 365.25 days. On average an attacker would find it in about half that time.
Our generator is set to 5 words by default. Canada's and Australia's advice asks for at least 15 characters as well [1] [3]. The shortest words in this list have 3 letters, so 4 or more words with a separator always reach that.
A password strength meter can overstate a passphrase. Our own estimate (zxcvbn) does not know your words came from a known list, so for a generated passphrase we show the list figure in its place. How the estimate works
3The words must be random
"Three random words" is the UK NCSC's advice [4], and the word random matters. A song lyric, a quote or your children's names are what guessing tools try. The odds in Table 1 hold only if a generator picks the words. If you choose them yourself or swap them for nicer ones, they do not apply.
4Where it fits best
A passphrase is what you can remember, so it suits the few passwords you type by hand: your email, your computer, and above all a password manager's master password. New Zealand's Own Your Online says the master password "is the only one you have to remember" once the others are stored [5]. Let the manager make long random passwords for everything else.
Sources
- [1]Get Cyber Safe, Passphrases, passwords and PINs (Canada). Read the source. Read 30 October 2026.
- [2]Own Your Online, Create good passwords (New Zealand). Read the source. Read 30 October 2026.
- [3]ASD's ACSC, Personal cyber security handbook, published 7 October 2026 (Australia). Read the source. Read 30 October 2026.
- [4]National Cyber Security Centre, Three random words, published 21 December 2021 (United Kingdom). Read the source. Read 30 October 2026.
- [5]Own Your Online, Keep your data safe with a password manager (New Zealand). Read the source. Read 30 October 2026.