Passphrase vs Password: Which Is More Secure in 2026?

A passphrase and a password are equally secure when they carry the same entropy, and entropy comes only from what was chosen at random. Six words drawn at random from the 7,776-word EFF list give 77.5 bits; 12 random printable characters give 78.8. Use a passphrase for the few secrets you have to type from memory, and a random character password for everything a password manager fills in for you.

The part most comparisons skip is that "six words" means nothing until you know how big the list was. More on that below, because my own generator is a good example of why.

Passphrase vs password entropy: same formula, different alphabet

Both are measured the same way:

H = L × log₂(R)

L = number of symbols drawn (characters or words)
R = size of the set each symbol is drawn from

A printable ASCII character is drawn from 95 options, so it's worth log₂(95) ≈ 6.57 bits. A word from the EFF large list is drawn from 7,776 options (the 6⁵ outcomes of five dice), so it's worth log₂(7776) ≈ 12.92 bits. One word carries about as much as two random characters.

Here's how the two line up against an offline attack on a stolen hash. Speeds are from hashcat 6.2.6 on a single RTX 4090: 164.1 billion MD5 guesses per second, and about 5,750 per second for bcrypt at cost 10. Times are averages (half the keyspace).

Two things decide which column you live in, and neither is under your control: how the site stores your password, and whether it leaks. Pick the length assuming the worst column, which is MD5. An attacker who rents eight GPUs divides every number by eight.

These figures hold only for secrets a machine picked. A human-chosen password or phrase falls to dictionary and rule attacks long before the attacker gets anywhere near brute force.

A word is worth only as much as the list it came from

The 12.92 bits per word assume the EFF large list. A smaller list gives fewer bits per word, and the attacker always gets to assume they know the list, because for any web generator it ships in the page's JavaScript.

My own Password Generator is a case in point. Its passphrase mode draws from a built-in list of 995 short English words, so each word is worth log₂(995) ≈ 9.96 bits, not 12.92. The slider goes from 3 to 8 words, and the default is 4. Like everything else on the site, it runs in your browser and the result never leaves the page.

So with this list, 8 words is the setting I'd use for anything that matters, and 4 is only fine for a secret that's also protected by rate limiting on a live login. The "append number" toggle adds a random 0–99, which is worth 6.64 bits. Capitalizing every word adds nothing an attacker can't try in one extra pass, since it's all-or-nothing.

The picking itself uses crypto.getRandomValues(). That matters more than the list size. With Math.random(), V8's xorshift128+ state can be recovered from a handful of outputs, and then every "random" word after that is predictable no matter how many you draw.

Why strength meters overrate passphrases

Most strength meters, mine included, score a password by length and the character classes it contains. They have no idea a string is made of dictionary words. Feed gold-fire-hand-wheel into the Password Strength Checker and it sees 20 characters drawn from lowercase letters plus symbols (a 54-character pool), which works out to about 115 bits. The real figure, if those words came from my generator, is 39.8 bits.

For a passphrase, count the words and multiply by the bits per word of the list they came from. Use a character-based meter only for random character passwords, where its assumption actually holds.

Words you choose yourself don't count

The bits in the tables come from the dice or the CSPRNG, never from the words. Once you swap a drawn word for one you like better, that slot is worth far less than 12.92 bits, because attackers build their wordlists from the words people like. summer-beach-vacation-happy looks like four words' worth of entropy, but those four words sit together in countless real sentences, and phrase lists built from text corpora try exactly that kind of combination early.

The xkcd "correct horse battery staple" comic (#936, 2011) got the method right: four words drawn at random from a 2,048-word list, which it puts at about 44 bits. That was a reasonable bar for an online login with rate limiting in 2011. It's not enough for a master password whose vault file could leak, and the phrase itself is now in every cracking wordlist.

The same applies to mixing a random part into your own phrase, which I do for the few passwords I type by hand. Only the random part adds entropy, so size it as if the rest weren't there. I covered that approach in how to create a strong password.

Length limits and typing

Passphrases are long. Eight words from my list plus separators come to 39–47 characters. NIST SP 800-63B Rev. 4 says verifiers should accept at least 64 characters, but plenty of older systems still cap length at 20 or 32. If a site rejects the passphrase, generate a random character password up to its limit instead of shortening the phrase.

Where passphrases win is anywhere you type without autofill: a manager's master password, a disk-encryption prompt at boot, a phone keyboard. Words are faster and less error-prone to type than K7#mWqP!v2xL9@nR, and a secret that's painful to type is the one people quietly weaken later.

Where I use each

My setup is the browser's built-in password manager plus Psono. Almost everything in there is a random character password I've never read. The handful I type myself are passphrases, and they're English only.

If you want the reasoning behind the minimum lengths, password entropy and minimum length walks through it, and how long it takes to crack a password has the full GPU tables.

FAQ

Is correct horse battery staple still a good passphrase?

That exact phrase is not: it's one of the most published passphrases on the internet and sits in every cracking wordlist. The method still works, but the comic's version was 4 words from a 2,048-word list, about 44 bits. Use 6 words from a 7,776-word list instead.

Are passphrases vulnerable to dictionary attacks?

The entropy figures already assume a dictionary attack: the attacker is given your exact wordlist and only has to guess which words were drawn. A randomly drawn passphrase holds up anyway. A phrase you composed yourself does not, because people pick predictable words.