How many words should a passphrase have to be secure?

Using the EFF large Diceware word list (7,776 words), you need at least 7 words to exceed 90 bits of entropy (90.4 bits). Six words gives 77.5 bits — strong but slightly below the 80-bit recommended minimum. Four words gives only 51.7 bits, which is considered weak.

Password vs Passphrase: Which Is More Secure?

Q: Are passphrases more secure than passwords?

It depends on how they are generated. A 6-word Diceware passphrase (EFF large word list, 7,776 words) provides 77.5 bits of entropy. A 16-character random password using all character types provides 102 bits. Random passwords are more entropy-dense per character, but passphrases are easier to remember. Both are far stronger than human-invented passwords.

Q: What is Diceware and how secure is it?

Diceware is a method for generating passphrases by rolling physical dice and looking up words in a standardized word list. The EFF large Diceware list has 7,776 words (6 dice rolls per word). Each word contributes log₂(7776) ≈ 12.9 bits of entropy. A 6-word Diceware passphrase gives 77.5 bits; a 7-word passphrase gives 90.4 bits.

Q: Can I use common words in a passphrase?

Only if the words are selected truly randomly from a large word list. A passphrase you invent yourself — like 'ilovebasketball' — has very low entropy because humans are predictable. Security comes from the randomness of selection, not from the words themselves.

The debate between passwords and passphrases comes down to a trade-off: entropy density vs. memorability. A random password packs more bits of entropy into fewer characters. A passphrase is longer but easier to remember. Both are far stronger than anything a human invents without a generator.

What Is a Traditional Password?

A traditional password is a random string of characters drawn from a mixed pool.

Example: Kx#9mP!qN7@wR3vL

Length: 16 characters
Pool: 83 characters (lowercase + uppercase + digits + 21 symbols)
Entropy: 16 × log₂(83) ≈ 102 bits

Strengths: Very high entropy per character. Weaknesses: Hard to type or memorize without a password manager.

What Is a Passphrase?

A passphrase is a sequence of randomly chosen words, typically from a standardized word list.

Example: correct-horse-battery-staple (4 words, EFF list)

The key word is randomly. The famous xkcd comic #936 popularized this idea: four random words can be both memorable and secure — but only if selected using a truly random process like physical dice or a CSPRNG. Words you choose yourself are not random.

Diceware and the EFF Word List

The most trusted passphrase standard is Diceware, using the EFF's large word list (7,776 words, corresponding to 5 physical dice rolls per word). Each word provides exactly log₂(7,776) ≈ 12.93 bits of entropy.

Entropy Comparison

EFF Diceware Passphrases (7,776 word list)

Word Count	Example	Entropy	Verdict
4 words	correct-horse-battery-staple	51.7 bits	Weak
5 words	correct-horse-battery-staple-light	64.6 bits	Moderate
6 words	6 random EFF words	77.5 bits	Strong
7 words	7 random EFF words	90.4 bits ✓	Very Strong

Note: The famous 4-word example from xkcd #936 gives only 51.7 bits against the EFF list — adequate in 2011, but below today's recommended 80-bit minimum. Use at least 6–7 words.

Random Passwords (this tool)

Length	Types	Pool	Entropy	Verdict
12	All types	83	76.5 bits	Moderate–Strong
16	All types	83	102.0 bits ✓	Very Strong
20	All types	83	127.5 bits	Extremely Strong

Side-by-Side Comparison

Factor	Random Password (16 chars)	Passphrase (7 EFF words)
Entropy	102 bits	90 bits
Length	16 chars	~40–50 chars
Memorability	Requires manager	Can be remembered
Typing on TV / device	Difficult	Easier
Generation method	CSPRNG required	Dice or CSPRNG
Site compatibility	Universal	May exceed length limits

When to Use a Passphrase

Passphrases are ideal when you need to memorize a credential:

Master password for your password manager
Full-disk encryption (LUKS, FileVault, BitLocker)
WiFi password (easier to enter on smart TVs and game consoles) — see our WiFi password guide
Any account without browser autofill

When to Use a Random Password

Random passwords are ideal for most online accounts when stored in a password manager:

Email, banking, and social media accounts
Any site where you use autofill
Situations requiring maximum entropy in a short string

Common Misconceptions

"Any four random words are secure"

Only if selected from a large standardized list using a random process. "Winter sunny coffee beach" seems random but entropy depends entirely on the selection method and word pool. Words chosen from a 100-word mental vocabulary provide far less than 51.7 bits.

"Adding symbols to a passphrase makes it much stronger"

Slightly. A 6-word EFF passphrase gives 77.5 bits. Adding a number and symbol at the end adds perhaps 10–15 bits depending on randomness. The words themselves are doing most of the work.

"Longer passwords are always better"

Length helps, but only when the characters are randomly chosen. A 50-character sentence you invented yourself may have far less entropy than a 16-character randomly generated password because human choices are predictable.

FAQ

Are passphrases more secure than passwords?

A 7-word EFF Diceware passphrase (90.4 bits) and a 16-character random password (102 bits) are both extremely strong. Random passwords are more entropy-dense; passphrases are easier to remember. For memorized credentials, use a passphrase. For everything else, use a random password stored in a password manager.

What is Diceware and how secure is it?

Diceware uses physical dice to select words from the EFF's 7,776-word list. Each word contributes 12.93 bits of entropy. Six words gives 77.5 bits; seven words gives 90.4 bits — both strong enough for most use cases.

How many words should a passphrase have?

At least 6 words from the EFF large list (77.5 bits). Seven or more words is recommended for accounts that protect very sensitive data (master passwords, disk encryption). Four-word passphrases (51.7 bits) are below the modern recommended minimum.

Can I use common words in a passphrase?

Yes — but only if they are selected randomly from a large word list. Security comes entirely from the randomness of selection, not the words themselves. Human word selection is predictable and provides far less entropy than it appears.

Generate a secure password or memorable passphrase: use the secure password generator.

Also read: Password Entropy Explained • Strong WiFi Password Examples

We do not collect, store, or transmit any passwords.