# What is a passphrase?

> A password made of several randomly chosen words rather than random characters, traded for human memorability.

Last reviewed: 2026-09-01

## Passphrase

Category: Passwords

Also called: diceware passphrase, word-based password

Canonical page: https://moolkey.com/glossary/passphrase

A passphrase is a password built from several randomly chosen words, such as "trout-canyon-mellow-drift". It carries less entropy per character than a random string but far more per unit of human effort, which makes it the right choice for the handful of secrets you must recall from memory.

### Why random selection is non-negotiable

The strength of a passphrase comes entirely from the words being chosen by a machine, not by you. A self-invented phrase follows grammar, cultural reference, and personal association. Cracking tools model all three with song lyrics, book text, and scraped social media.

Four genuinely random words from a 1,296-word list sit in a space of 2.8 trillion possibilities. A four-word sentence you composed yourself may sit in a space of a few million.

### Does a public wordlist weaken it

No. This is the most common objection and it is wrong. Security comes from the number of equally likely combinations, not from the list being secret. Publishing the list lets anyone verify the entropy claim, which is a feature.

### Where passphrases beat random strings

Master passwords, disk encryption, and anything typed on a television remote, games console, or car system. For the hundreds of accounts your software fills in for you, a random character password is denser and just as convenient.

Further reading: [Generate a passphrase](https://moolkey.com/tools/passphrase-generator)

### Sources

- [EFF: Dice-generated passphrases](https://www.eff.org/dice): Wordlists and a verifiable method for choosing passphrase words at random.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.