Home / Guides / Password vs Passphrase
Password vs Passphrase
One is a random string of characters. The other is a handful of random words strung together. Here's how they actually compare, not just in theory.
The core tradeoff
Both approaches are trying to maximize entropy: how many possible outcomes an attacker would have to search through. A password gets its entropy from a large character set (uppercase, lowercase, digits, symbols) packed into a relatively short string. A passphrase gets its entropy from a large word list, with each additional word multiplying the possibilities by roughly the size of that list. Done right, both can reach the same security level. The real difference is what's easier for a human to actually use.
The entropy math, briefly
A random passphrase built from a 7,776-word list (the size of the well-known EFF word list, chosen specifically because it's a power of 6, convenient for dice-based selection) gives about 12.9 bits of entropy per word. Six random words from that list works out to roughly 77 bits of entropy, comparable to a much harder to remember, fully random 12-13 character password across the full 95-character printable ASCII set. The passphrase gets there with six recognizable words. The password needs a jumble of symbols most people can't hold in memory.
When each one makes more sense
- Use a password when it's going into a password manager and you'll never type it by hand. Shorter is more convenient to store, and there's no memorability tradeoff to worry about.
- Use a passphrase for anything you actually need to type or remember yourself: a device unlock code, a Wi-Fi password you'll read aloud to a guest, or a master password for the password manager itself (since that one genuinely does need to live in your memory).
- Either works for most day-to-day account passwords if you're using a password manager, which is the setup NIST's current guidance generally assumes.
Generate either on the Password / Passphrase panel. The passphrase mode draws randomly from a word list using the same CSPRNG as every other tool on this site, not a shortened or predictable subset.
Frequently asked questions
Is a passphrase always more secure than a password?
Not automatically. It depends on the word count and how the words are chosen. A passphrase built from a small, predictable word list or common phrases can be weaker than it looks. A passphrase generated by randomly selecting words from a large list, the way this site's generator does it, is what makes the entropy math work out in its favor.
Which one should I actually use?
If you're using a password manager, it barely matters. You're not typing or memorizing it either way, so a fully random character password is fine and often shorter. If you need to actually remember and type the credential yourself, a passphrase is usually the more practical choice at equivalent security.
- NIST SP 800-63B Revision 4, Digital Identity Guidelines; see also NIST's 2025 Password Rule Change
- Electronic Frontier Foundation, EFF Long Wordlist methodology for dice-generated passphrases