Password vs Passphrase
Two different tools for two different jobs. Here's how to actually decide, with the entropy math to back it up.
The Core Difference
A password is a string of individually random characters (kX9$mQ2!vR7p). A passphrase is a sequence of randomly selected whole words, usually joined with a separator (flame-river-bolt-echo-crane). Both can be generated with equal randomness. The difference is what unit is being randomised: a character, or a word.
Comparing Entropy
Entropy per character in a random password (94-character pool): about 6.55 bits. Entropy per word in a passphrase drawn from a wordlist depends entirely on the wordlist's size. A 256-word list gives 8 bits per word; the well-known EFF long wordlist (7,776 words) gives about 12.9 bits per word.
| Type | Length | Entropy | Rating |
|---|---|---|---|
| Random password | 12 characters | ~78 bits | Strong |
| Random password | 16 characters | ~105 bits | Very Strong |
| Passphrase (7,776-word list) | 4 words | ~52 bits | Fair |
| Passphrase (7,776-word list) | 5 words ⭐ | ~65 bits | Strong |
| Passphrase (7,776-word list) | 6 words | ~77 bits | Strong |
A 16-character random password beats a 6-word passphrase on raw entropy. But that comparison misses the point: the two exist for different situations.
When to Use Each
| Situation | Use |
|---|---|
| Any account stored in a password manager | Random password: no memorisation cost, so maximise entropy |
| Your password manager's master password | Passphrase: you must type this from memory, often |
| Device login / disk encryption | Passphrase: typed frequently, needs to be memorised |
| A credential you'll read aloud or share verbally | Passphrase: words are far less error-prone to communicate than random characters |
| An API key, database password, or service account | Random password: machine-to-machine, memorability irrelevant |
Why a Meaningful Sentence Isn't a Good Passphrase
"ILoveMyDogMax2023!" looks like a passphrase but isn't a secure one. Its security depends on random, independent word selection from a large pool, not on forming grammatically correct, meaningful text. A real sentence draws from the much smaller, much more predictable space of things people actually say, which cracking tools model directly using natural-language statistics. A true passphrase's words should have no relationship to each other beyond being selected at random.
Practical Recommendations
- For password-manager-stored accounts: use our Strong Password Generator at 16+ characters.
- For your password manager's master password: use our Passphrase Generator at 5-6 words.
- Never mix the two goals. Don't try to memorise a 20-character random password, and don't rely on a 3-word passphrase for a stored account where you could easily use more entropy.
Frequently Asked Questions
Not automatically. A random character password has higher entropy per position. But a long enough passphrase (5-6 words) reaches strong entropy while being far easier to memorise. The right choice depends on whether you need to remember it.
5-6 words from a large wordlist typically gives 60-80+ bits of entropy, strong enough for most purposes, including a password manager master password.
A meaningful, grammatically correct sentence draws from a far smaller, more predictable space than randomly selected independent words. A passphrase's security comes from random word selection, not from forming a sentence.