Short answer: A passphrase — four or five random words strung together — is usually stronger than the short, symbol-heavy password most people create, and vastly easier to remember. But length is what matters, not style. A 20-character random password from a password manager beats both. The only passwords you should ever memorise are the two or three you genuinely have to type: your device login and your password manager master password.
What makes a password hard to crack
Two things: how long it is, and how unpredictable each character is. Length wins.
Every additional character multiplies the number of possibilities an attacker must work through. Adding a symbol to an eight-character password helps a little. Making it sixteen characters helps enormously. This is why “add a special character” advice produced a generation of passwords like Password1! — technically compliant, trivially guessed.
The other half is predictability. Attackers do not try every combination blindly; they try dictionary words first, then common substitutions (a→@, e→3), then leaked passwords from previous breaches, then patterns like a capital at the start and a number at the end. Human-chosen passwords cluster hard around those patterns.
Why passphrases work
A passphrase is several random words: correct-battery-mountain-lantern. Four random words from a large word list produce enormous unpredictability, and the result is 30-odd characters long without feeling like it.
The crucial qualifier is random. A memorable sentence you composed yourself — a song lyric, a phrase about your dog, a quote — is not random. Attackers run cracking dictionaries built from books, lyrics, films and social media. “Ilovemydogmax2019” looks long and is not strong.
The reliable method is to let something else pick the words: dice and a word list (the Diceware approach), or your password manager’s passphrase generator. Then you get genuine randomness with genuine memorability, which is a rare combination.
The honest comparison
- Short complex password (
Tr0ub4dor&3) — hard for a human to remember, easy for a machine. The worst of both. - Random passphrase (
anchor-velvet-pigeon-drift) — easy to remember, very strong, easy to type on a phone. Ideal for the passwords you must memorise. - Long random string (
7Kx#mQ2vLp$9nRw4) — strongest per character, impossible to remember. Ideal for everything a password manager stores for you.
These are not competitors so much as tools for different jobs.
The rule that matters more than either
Uniqueness beats strength.
A brilliantly strong password reused across twenty sites fails completely the moment one of those sites is breached. Attackers replay leaked pairs everywhere — see what is credential stuffing. Your security across all twenty accounts becomes whatever the worst-run site’s security was.
Meanwhile a mediocre but unique password limits the damage to exactly one account.
Nobody can memorise fifty unique passwords, which is why the practical answer is a password manager: it generates and stores long random strings, and you memorise one passphrase to unlock it. See do password managers get hacked? for the security question that usually follows.
A working system
- Memorise two or three passphrases: your device login, your password manager master password, and possibly your primary email.
- Let the password manager generate everything else — long, random, unique, never typed by hand.
- Add 2FA on top, starting with email. Even a leaked password becomes largely useless behind a second factor — Google, Microsoft.
- Use passkeys where offered. No password exists to be guessed, leaked or phished — see passkeys vs 2FA.
- Check what has leaked and fix reuse: how to check if your password has been leaked.
Advice worth ignoring
- “Change your password every 90 days.” Modern guidance from NIST and the UK’s NCSC advises against forced rotation — it pushes people toward predictable variations. Change on suspicion of compromise, not on a calendar.
- “Never write it down.” A written passphrase in a locked drawer at home is safe from someone in another country. Written on a sticky note on a shared monitor is not. Judge by who can physically reach it.
- “Complexity requirements make you safe.” They mostly produce
Summer2026!. Length and uniqueness do the work. - “Use a formula with the site name.”
Fbook-mypass-99,Amzn-mypass-99. Once one leaks, the pattern is obvious to a human reviewer and to automated tools.
Frequently asked questions
How many words should a passphrase have?
Four random words is a reasonable minimum for most accounts; five or six for a password manager master password or device login. Use a generator rather than choosing them yourself.
Do I need symbols and numbers in a passphrase?
Not for strength, if it is genuinely random and long enough. Add them where a site’s rules demand it — separators like hyphens usually satisfy the requirement.
Are spaces allowed?
Most modern sites accept them. Some do not, which is why hyphens or underscores between words are a practical default.
Is my password strong enough?
Ask two questions instead: is it unique to this account, and is it long? If yes to both, it is fine. Be wary of online strength meters — they judge patterns crudely and some are collecting what you type.
Should I use a password manager’s generated passphrase or random string?
Random string for anything the manager stores and fills. Passphrase for the handful you type by hand.
What if someone sees me typing my passphrase?
Same risk as any password, and a reason your device should also require biometrics. If you think it was observed, change it — and note that this is exactly why phone theft after passcode-watching is such an effective attack. See is biometrics really 2FA?
The bottom line
Passphrases beat the short complex passwords humans actually create, and random strings from a manager beat both. But the argument is smaller than it looks: uniqueness matters more than either, and a second factor matters more than the password. Memorise two or three good passphrases, let software handle the rest, and turn on 2FA where it counts.
Ready for the second factor? Start with what an authenticator app is.
2 Responses