Passwords are the weakest link in most security setups — not because of the alphabet, but because humans insist on creating them. A passphrase turns that weakness into a strength: it is long enough to be secure and memorable enough to type without a manager.
Why length beats complexity
Attackers crack passwords by guessing combinations. Every additional character multiplies the number of possibilities, so a 20-character passphrase contains vastly more combinations than a 10-character password full of symbols. In entropy terms, four random words from a 180-word list create roughly the same protection as a 13-character random password — while being far easier to remember.
How to build a strong passphrase
- Use at least 4 random words — never a famous quote or a song lyric.
- Add a separator between words such as a hyphen, dot or underscore.
- Mix in a random number or symbol occasionally.
- Never reuse the same passphrase across different websites.
What makes a weak passphrase
A quote from a movie, a sentence from a book or a phrase related to your life can be guessed or searched. True randomness is what matters — which is why our passphrase generator picks words from a curated list using cryptographically secure random numbers.
Passphrase best practices
Use passphrases for your password manager master key and for critical accounts you access often. For everything else, a generated random password stored in a manager is the most practical approach. Combine both habits and you cover convenience, memory and security.
Measure your passphrase
You do not have to guess whether a passphrase is strong enough. Paste it into our Check tab and see its entropy in bits and an estimated crack time — the analysis runs entirely in your browser.