"Just use a passphrase, it's stronger than a password" is one of the most repeated pieces of security advice — and one of the most misunderstood. A passphrase can be dramatically stronger than a random password, or dramatically weaker, depending entirely on how it was constructed. The word "passphrase" describes a format, not a strength guarantee. This article settles the question with the only thing that matters: entropy, measured in bits, and the cost of cracking each construction. We will compare a diceware-style passphrase against a random character string head to head, show the math, and explain when each one wins.
The Only Metric That Matters — Entropy
Both passphrases and random passwords are evaluated with the same yardstick: bits of entropy, the base-2 logarithm of the number of equally likely outputs the generation process could have produced. Entropy is a property of the process, not the resulting string. The string correct horse battery staple and the string x7Qm$2pL tell you nothing about their own strength in isolation — you have to know how each was generated. If both were chosen uniformly at random from a defined space, you compute the space size and take its logarithm.
For a random character password drawing each character independently and uniformly from a pool of N symbols, entropy is length × log₂(N). For a passphrase drawing each word independently and uniformly from a wordlist of W words, entropy is words × log₂(W). That symmetry is the heart of the comparison: a word is just a "character" drawn from a much larger alphabet.
Diceware — Where Passphrase Entropy Comes From
The canonical passphrase method is Diceware, introduced by Arnold Reinhold in 1995. You roll five physical six-sided dice, producing a number from 11111 to 66666, and look it up in a list of exactly 6⁵ = 7,776 words. Each word therefore contributes log₂(7,776) ≈ 12.92 bits of entropy. The EFF published a refined 7,776-word list in 2016 (the "EFF Long Wordlist") that removes confusable and offensive entries while preserving the exact 6⁵ count, so the per-word entropy is unchanged.
The arithmetic is then trivial and exact:
- 4 words →
4 × 12.92 ≈ 51.7 bits - 5 words →
5 × 12.92 ≈ 64.6 bits - 6 words →
6 × 12.92 ≈ 77.5 bits - 7 words →
7 × 12.92 ≈ 90.4 bits - 8 words →
8 × 12.92 ≈ 103.4 bits
Crucially, this only holds if the words are chosen by an unbiased random process — dice, or a CSPRNG. A human "thinking of four random words" produces nothing close to 51.7 bits, because human word choice is heavily skewed toward common, semantically related, grammatically ordered words. The entropy of my dog loves bacon is a tiny fraction of four genuinely random Diceware words.
The Head-to-Head Comparison
Now we can answer the title question with numbers. Consider a random password from the full 94-character printable-ASCII pool (uppercase, lowercase, digits, symbols). Each character is worth log₂(94) ≈ 6.55 bits. So:
- A 10-character random password →
10 × 6.55 ≈ 65.5 bits— roughly equal to a 5-word Diceware passphrase (64.6 bits). - A 12-character random password →
12 × 6.55 ≈ 78.6 bits— roughly equal to a 6-word passphrase (77.5 bits). - A 20-character random password →
20 × 6.55 ≈ 131 bits— exceeding a 10-word passphrase (129 bits).
So per character typed, a full-pool random password is far more entropy-dense: a 6-word passphrase averages around 28–30 characters including spaces, while a 12-character random string matches it. If your only goal were minimizing keystrokes at a fixed entropy, the random password wins outright. But keystrokes are not the only cost — memorability is, and that is where passphrases earn their reputation.
Which Is Actually Harder to Crack?
"Harder to crack" depends on the attack. There are two fundamentally different scenarios, and conflating them is the source of most confusion.
Online attacks (rate-limited)
When an attacker must submit guesses to a live service, they are throttled by rate limiting, lockouts, and network latency — typically to fewer than a few thousand guesses per hour. At this rate, anything above ~40 bits is uncrackable in any human timeframe. Both a 4-word passphrase and a random 8-character password are completely safe online. Here the comparison is irrelevant; either format wins.
Offline attacks (hash cracking)
The dangerous case is when a service is breached and the attacker obtains password hashes to crack offline at full hardware speed. Here the hash function matters enormously. Against a fast hash like unsalted SHA-1, a modern GPU cluster reaches 10¹²–10¹³ guesses per second. Against a deliberately slow hash like bcrypt (cost 12), Argon2id, or PBKDF2 with high iteration counts — as mandated for memorized secrets in NIST SP 800-63B section 5.1.1.2 — the same hardware manages only thousands to low millions per second. The defender's choice of hash buys 6–9 orders of magnitude.
Let's price a 5-word passphrase (64.6 bits ≈ 2.8 × 10¹⁹ candidates) against the worst case — a fast hash at 10¹² guesses/sec. Average time to crack is half the keyspace: 1.4 × 10¹⁹ ÷ 10¹² ≈ 1.4 × 10⁷ seconds ≈ 162 days. Borderline. A 6-word passphrase (77.5 bits) raises that to roughly 3,500 years. A 20-character random password (131 bits) is ~10¹⁹–10²⁰ years — heat-death-of-the-universe territory. The conclusion: against offline cracking, raw bit count is the whole game, and the format is irrelevant once you control for entropy.
The Attacker Knows Your Format
A common objection: "but the attacker knows I used Diceware, so they can target the wordlist." This is true, and the entropy math already accounts for it. The 12.92 bits/word figure assumes the attacker has the wordlist and is brute-forcing word combinations rather than character combinations — that is precisely why we compute log₂(7,776) and not log₂(26^average_word_length). There is no hidden penalty. Kerckhoffs's principle applies: security must rest on the secret (which words were chosen), never on hiding the method. The same holds for random passwords: assume the attacker knows your length and character pool. Honest entropy accounting always assumes the worst-case-known method.
The reverse mistake is more dangerous. Estimating a passphrase's strength by feeding it into a per-character entropy estimator (like a naive length × log₂(94) meter) overstates it wildly, because the meter assumes random characters when the real generation was per-word. Conversely, dictionary-aware strength meters like zxcvbn correctly recognize common words and can understate a genuinely random Diceware phrase, because they cannot tell a random selection from a memorable one. Always compute passphrase entropy from words × log₂(wordlist_size), never from a character meter.
One-Time-Password Lineage — A Historical Aside
The idea of mapping random bits to memorable words predates Diceware in protocol design. RFC 2289 ("A One-Time Password System", 1998) and its predecessor RFC 1760 (the S/KEY system) defined a standard dictionary of 2,048 short words used to encode a 64-bit one-time password as six English words. With 2,048 = 2¹¹ words, each word carries exactly 11 bits, so six words encode 66 bits — chosen deliberately to make a machine-generated secret transcribable by a human without error. That lineage is why the "random words are memorable" insight is baked into decades of security engineering, not a recent trend.
When the Passphrase Wins
Passphrases dominate in exactly one situation, but it is an important one: secrets you must memorize and type by hand. Your password manager's master password, a full-disk encryption key, an SSH key passphrase, a recovery code — these cannot live in a manager (they protect the manager itself) and must survive in human memory. Here a 6–7 word Diceware phrase delivers 77–90 bits with a memorization burden a random 14-character string could never match. Cognitive-science studies of passphrase recall consistently show multi-word phrases are retained far better than equal-entropy random strings, and typing them on a phone keyboard is faster and less error-prone.
When the Random Password Wins
For the 99% of credentials that live inside a password manager and are filled automatically, you never type or memorize them — so memorability has zero value, and entropy density (and avoiding any wordlist patterns) is all that matters. Here a 20-character full-pool random string is the right default: maximum entropy in minimum length, no linguistic structure for a smart cracker to exploit, and trivially generated. The general rule that emerges: random passwords for everything a manager stores; passphrases for the handful of secrets you carry in your head.
Common Mistakes That Destroy Passphrase Entropy
- Choosing the words yourself. Human-selected words collapse 50+ bits to under 20. The dice (or a CSPRNG) are not optional.
- Using too few words. A 3-word phrase is only ~38 bits — crackable offline in hours against a fast hash. Five words is the practical floor; six for high-value secrets.
- Adding "memorable" structure. Forcing the words into a grammatical sentence, sorting them, or picking a theme reduces the effective space and is exactly what targeted crackers model.
- Tiny wordlists. A 1,000-word list gives only
~9.97 bits/word; the 7,776-word Diceware/EFF list is the standard for a reason. Bigger reputable lists (the EFF "Short" lists trade word length for list size) shift the tradeoff but the entropy followslog₂(W)exactly.
Verify the Math Yourself
You can sanity-check any passphrase's entropy budget by counting its words against your wordlist size, and check a random password's length is doing what you expect. Paste a candidate phrase into our Word Counter to confirm the exact word count, then multiply by log₂(7,776) ≈ 12.92. To generate the secrets themselves with a cryptographically secure source — both random character passwords and the underlying randomness for word selection — use the Password Generator, which draws from crypto.getRandomValues() and reports entropy in bits with a NIST-aligned label. For the deeper background on entropy, length-versus-complexity, and modern NIST guidance, see our companion guide How to Create Secure Passwords.
The Verdict
Neither format is inherently "stronger." Strength is entropy, and entropy is determined by the randomness of the generation process, not by whether the result reads as words or symbols. At equal entropy, a passphrase and a random password are exactly equally hard to crack — the attacker's optimal strategy costs the same against both. The real decision is about cost of use: random passwords pack more entropy per character and win for manager-stored credentials; Diceware passphrases trade length for memorability and win for the few secrets you must carry in your head. Generate both with real randomness, never with human intuition, and size them to your threat model — 5–6 words or 12–20 characters for most accounts, more for the roots of trust.