What is a passphrase?
A passphrase is a password built from several randomly chosen words, such as "trout-canyon-mellow-drift". It carries less entropy per character than a random string but far more per unit of human effort, which makes it the right choice for the handful of secrets you must recall from memory.
- Topic
- Passwords
- Also called
- diceware passphrase, word-based password
- Reading time
- 1 min
- Reviewed
On this page
Why random selection is non-negotiable
The strength of a passphrase comes entirely from the words being chosen by a machine, not by you. A self-invented phrase follows grammar, cultural reference, and personal association. Cracking tools model all three with song lyrics, book text, and scraped social media.
Four genuinely random words from a 1,296-word list sit in a space of 2.8 trillion possibilities. A four-word sentence you composed yourself may sit in a space of a few million.
Does a public wordlist weaken it
No. This is the most common objection and it is wrong. Security comes from the number of equally likely combinations, not from the list being secret. Publishing the list lets anyone verify the entropy claim, which is a feature.
Where passphrases beat random strings
Master passwords, disk encryption, and anything typed on a television remote, games console, or car system. For the hundreds of accounts your software fills in for you, a random character password is denser and just as convenient.
Sources
These primary references support the terminology and current security guidance used in this definition.
