A passphrase is several random words strung together. Done properly, it can be as strong as a long random password while being far easier to remember and type.
The math
Entropy counts the choices made at random. For a password, each character is one choice from the character set. For a passphrase, each word is one choice from a word list.
- A standard diceware list has 7,776 words, so each random word adds log₂ 7,776 ≈ 12.9 bits.
- 4 words ≈ 51.7 bits, 5 words ≈ 64.6 bits, 6 words ≈ 77.5 bits, 7 words ≈ 90.5 bits.
Compared with random characters
A random letters-and-digits password carries about 5.95 bits per character, so 6 random words (77.5 bits) roughly match a 13-character random password.
Bits per character
log₂ 62equals5.95
Entropy
12 × 5.95equals71.5 bits
Average time
62¹² ÷ 2 ÷ 10,000,000,000/sequals5,112 years
The catch: the words must be random
The math only holds if the words are picked at random, by dice or a generator, not chosen by you. A phrase from a song, a quote or a sentence you made up has much less entropy, because attackers try common phrases first.
Tip: Use a generator or real dice to pick the words, and separate them with spaces or dashes you'll remember. Capitalization tricks add little compared with one extra word.