Passphrase vs Password: Which Is More Secure?
Random passwords and random-word passphrases can both be strong. The better choice depends on whether you need to remember or type the secret yourself, or can let a password manager handle it.
What is the difference?
A random password draws characters from a pool such as letters, numbers and symbols. A passphrase draws whole words from a word list and joins several unrelated choices together.
The important word in both cases is random. A sentence you already know is not equivalent to several independently selected random words.
When a random password is best
A random character password is compact and works particularly well when a password manager generates, stores and fills it. You do not have to make it pronounceable or memorable, so the generator can focus on length and unpredictability.
Use a different value for every account. Reuse defeats one of the biggest benefits of generated passwords.
When a passphrase is useful
A passphrase can be convenient when you genuinely need to type or remember a credential. Several unrelated randomly selected words create a longer secret without requiring you to remember a dense string of punctuation.
Do not choose a quotation, personal phrase or a sequence of related words. Human-selected phrases tend to contain patterns that automated guessing can exploit.
How to choose between them
If a password manager will remember the credential, use a long random password that meets the website’s rules. If you need a memorable credential, a random-word passphrase can be a practical alternative.
Whatever format you choose, keep it unique, protect important accounts with an additional verification method and replace the credential promptly if it may have been exposed.
Create a private random password locally in your browser, then save it securely and use it for one account only.
Open Password Generator →Frequently asked questions
Is a passphrase safer than a password?
Either can be strong when it is sufficiently long, genuinely random and unique. The format matters less than the quality of the random selection and how the credential is stored.
How many words should a passphrase contain?
More independently selected random words increase the possible combinations. Follow the service’s rules and use enough words to create a long, hard-to-guess passphrase.
Can I use a favourite quote as a passphrase?
That is not a good substitute for random words because quotations and familiar phrases are predictable and can appear in guessing dictionaries.
Should passphrases be unique too?
Yes. Never reuse an important passphrase across accounts.
More password security guides
Password security basics · Password length · Passphrase vs password · Password strength · Random password generators