Passphrases vs. Passwords: Which is Better?

The Problem with Traditional Passwords

For decades, IT departments mandated "complex" passwords. A user might try to make a secure password by taking a base word and altering it: Tr0ub4dor&3.

The XKCD comic pointed out two critical flaws with this approach:

1. It's hard for humans to remember: Looking at Tr0ub4dor&3 requires rote memorization of arbitrary character substitutions. It causes immense frustration and leads to people writing it on sticky notes.
2. It's easy for computers to guess: From a mathematical standpoint, this password is only 11 characters long. Worse, attackers know exactly the kind of substitutions humans make (replacing 'o' with '0', 'a' with '4'). Because the base word is in the dictionary, modern cracking algorithms will guess it almost instantly.

Enter the Passphrase

The proposed alternative was the passphrase: a sequence of completely random, unrelated common words strung together.

The comic's example was: correct horse battery staple.

Why it's better for computers

Even though it uses zero complex characters (no numbers, no symbols, no uppercase letters), it is 28 characters long. The mathematics of entropy dictate that length is exponentially more powerful than a larger character pool. While a cracking rig might guess the 11-character complex password in three days, it would take hundreds of years to brute-force a 28-character lowercase string.

(Note: Attackers do use "dictionary attacks" that try combinations of words, so a passphrase must contain at least 4 to 6 random words to defeat this).

Why it's better for humans

Human memory is associative and visual. It is incredibly difficult to visualize Tr0ub4dor&3. However, it is remarkably easy to visualize a horse correctly repairing a battery with a staple. You only have to imagine the bizarre scene once, and you will likely remember the passphrase for years.

When to use a Passphrase vs a Password

Does this mean we should abandon complex passwords entirely? Not quite. They both have specific use cases in a modern security setup.

When to use a Passphrase

You should use a passphrase anytime a human brain has to actively remember and type the credential. The most critical example of this is your Master Password for your password manager, or the encryption key for your computer's hard drive.

• Must be memorized.
• Must be typed manually (often on a mobile device where symbols are annoying to type).
• Needs to be highly secure.

When to use a Password (Generated)

You should use a traditional, highly complex, randomly generated password (e.g., xQ7!mP2@vL9$kB5*) for everything else.

Because you should be using a password manager, your brain never has to remember or type the passwords for your email, bank, or social media accounts. The password manager handles it automatically. Since a computer is doing the remembering and typing, there is no reason not to maximize both length and complexity to achieve mathematical perfection.

How to Create a Good Passphrase

If you need to create a Master Password, follow these rules:

1. Do not use a famous quote: "tobeornottobethatisthequestion" is long, but it's in every hacker's dictionary. It will be cracked instantly.
2. Use a random generator: Humans are bad at picking random words. We tend to pick words that are related (e.g., red car fast drive). Use a tool like the EFF's Diceware word list, or the passphrase generator built into your password manager.
3. Aim for 5 to 6 words: Four words was acceptable in 2011, but as cracking hardware has advanced, 5 to 6 words is the modern recommendation.