The Real Difference
A random password packs its strength into a few characters from a large set, for example 16 characters from 94 symbols. A passphrase packs it into several random words from a list. Both are random, and both can be very strong. The difference is the form: a password is compact but hard to remember, and a passphrase is longer but easier to read, say and type.
What gives either of them strength is not the form but the entropy: how many equally likely possibilities an attacker would have to try. For random choices, that is the number of options per pick, raised to the number of picks.
The Numbers Side by Side
The table compares typical choices. Crack times are the average for an offline attack on a fast hash at 150 billion guesses per second, the same assumption as our crack-time table.
| Type | Random choices from | Entropy | Average crack time |
|---|---|---|---|
| Random password, 12 characters | 94 printable characters | 78.7 bits | 50 thousand years |
| Random password, 16 characters | 94 printable characters | 104.9 bits | 4 trillion years |
| Passphrase, 4 words | 7,776-word list | 51.7 bits | 3 hours |
| Passphrase, 6 words | 7,776-word list | 77.5 bits | 23 thousand years |
| Passphrase, 8 words | 7,776-word list | 103.4 bits | 1 trillion years |
| Passphrase, 6 words | our 1,069-word list | 60.4 bits | 58 days |
| Passphrase, 8 words | our 1,069-word list | 80.5 bits | 180 thousand years |
These figures apply only to passwords and passphrases chosen at random by a tool or by dice. Phrases picked by a person are far weaker.
Why the Word List Size Matters
The strength of a passphrase depends on how many words are in the list it is drawn from. The EFF's long Diceware list is chosen with five dice per word, and the EFF suggests a six-word passphrase for most uses, which it describes as about 277 possibilities. That works out to roughly 12.9 bits per word.
Our Passphrase Generator currently draws from a list of 1,069 words, which is about 10.1 bits per word. That is a smaller list, so the same number of words is weaker: six words from our list give about 60.4 bits, and eight words give about 80.5 bits. If you use our generator for something important, choose 8 or more words. The generator shows its word-list size and entropy on the page, so you can check the current figures yourself.
When to Use Each
| Situation | Best choice | Why |
|---|---|---|
| Password manager master password | Passphrase | You must remember it, and it protects everything else. |
| Device or disk encryption password | Passphrase | You type it often and need it memorable. |
| Wi-Fi password you share | Passphrase | Easier to read out and type on other devices. |
| Accounts saved in a password manager | Random password | You never type it, so compact length and symbols cost nothing. |
| Sites with length limits or symbol rules | Random password | A passphrase may not fit the rules. |
| Services that offer passkeys | Passkey | See passkeys explained. |
Passphrase Mistakes to Avoid
- Choosing the words yourself. People pick predictable words and phrases. Let a tool or dice choose them.
- Using a famous quote, lyric or line from a book. These appear in guessing lists.
- Relying on decoration. Capitalising a word or adding a number adds only a little. Add another random word instead.
- Reusing it. A strong passphrase reused on several sites is only as safe as the weakest one.
- Making it too short. Four random words are fine for low-risk uses but fall quickly to a fast offline attack. Use six or more words from a 7,776-word list, or eight from ours.
The Verdict
Neither is stronger by nature. A long random password and a long random passphrase can reach the same entropy. Use a random password where a password manager types it for you, and a passphrase where you have to remember it. In both cases, make it long, make it random, and make it unique. Standards guidance backs the focus on length: see our summary of the NIST password guidelines.
Sources
- EFF: Dice-generated passphrases: five dice per word, and a suggested minimum of six words, described as about 2^77 alternatives. Read on 7 October 2026.
- Calculations: entropy = number of choices × log2(pool or word-list size). Crack time = (possibilities ÷ 2) ÷ 150 billion guesses per second. See how the numbers are calculated.