The random-versus-memorable debate is usually framed as a matter of taste: security purists on one side with their xK9#mQ2$vL7p, pragmatists on the other with their four-word phrases. Framed that way, it's a false choice. The two approaches aren't competing answers to the same question - They're correct answers to different questions. Once you sort your accounts by who actually enters the password (you, or your software), the debate dissolves into a simple two-part policy that outperforms either camp's absolutism.
The real dividing line: who types it?
Count the passwords you genuinely type by hand in a normal month. For most people running a password manager, it's a startlingly short list: the manager's master password, a computer login, maybe a phone passcode's alphanumeric cousin. Everything else - The other 100-plus accounts - Is entered by autofill.
That census is the whole framework. For autofilled passwords, memorability contributes exactly nothing; you'll never recall them, so any concession to human memory is entropy left on the table. For hand-typed, must-remember passwords, memorability is a hard requirement; a password you can't reliably reproduce locks you out of everything, and there is no reset button on a properly built master password.
- Filled by software → random character string, maximum length the site allows.
- Typed and memorized by you → randomly generated passphrase.
- Invented by your own clever brain → nothing. This category should be empty.
Random strings: maximum entropy per character
A random string from a password generator drawing on the full 95-character printable set delivers about 6.6 bits of entropy per character - The densest strength you can pack into each keystroke. Sixteen characters gets you ~105 bits, past the point where offline cracking is plausible against any hashing scheme, fast or slow. The generation method matters: proper generators use a cryptographically secure randomness source, which is why their output has the entropy it claims - how random password generators work opens that box.
The weakness of random strings is purely human. They're miserable to memorize, worse to type on a phone keyboard, and impossible to relay over a phone call. None of that matters when software does the filling - Which is exactly why random strings are the correct choice for the software-filled category and a poor one anywhere else.
Passphrases: entropy that fits in a head
A passphrase built from randomly selected words - The Diceware approach - Trades entropy density for memorability. Each word drawn from the EFF's 7,776-word list carries about 12.9 bits, so six words deliver roughly 77 bits: weaker per character than random ASCII, but vastly easier to hold in memory, because your brain stores it as six familiar chunks rather than sixteen arbitrary symbols. maple-crater-onion-drift-plaza-hymn survives an offline attack for geological time and survives a Monday morning too.
The non-negotiable condition is that the words are chosen randomly - By dice or a passphrase generator, never by you. The moment you pick words that "go together," you collapse the search space: attackers try song lyrics, quotes, and grammatical sentences early. A five-word phrase from a random list beats a ten-word sentence you composed. The full method, wordlist math included, is in what is a passphrase.
Randomness is the ingredient; strings and phrases are just packaging. A password only carries real entropy if dice - Not a human - Made the choices.
The impostor: the "clever memorable" password
The category that actually loses is the one most people use: human-invented passwords engineered to feel both memorable and strong. Summer2026!, J&kWedding2019, P@ssw0rd-Chase. These fail on both axes at once.
They're weaker than they look because humans are wildly predictable in aggregate. We capitalize the first letter, put digits and symbols at the end, substitute @ for a, and reference names, dates, teams, and keyboard walks. Cracking tools encode all of this as mangling rules applied to breach-trained wordlists - Billions of leaked passwords have taught them exactly how people decorate words. A "16-character" invention often carries under 30 real bits. That's the mechanism behind the wreckage in the most common passwords, and it's why strength meters that merely count character classes flatter you.
They're also less memorable than they look. Which year did you use? Which word got the capital? Was it ! or !!? Multiply that fog across dozens of accounts and you get the familiar cycle: forget, reset, invent a near-duplicate, forget again. Worse, people solve the recall problem by reusing one clever password everywhere - Converting a single site breach into a skeleton key for their whole life.
Head to head
| Random string | Random-word passphrase | Human-invented "memorable" | |
|---|---|---|---|
| Entropy (typical) | ~105 bits (16 chars) | ~77 bits (6 words) | Often under 30 bits |
| Memorizable | Barely | Yes | Feels yes, proves no |
| Typing on a phone | Painful | Easy | Medium |
| Resists rule-based cracking | Yes | Yes (if words are random) | No - Rules target it directly |
| Best role | Everything your manager fills | Master password, device logins | None |
Putting the policy into practice
Step 1 - Fix the master password first. Generate a six-word passphrase, practice typing it a dozen times over two days, and let spaced repetition do its thing. This one password protects all the others, so it gets the most entropy your memory can carry - Seven words if you're cautious.
Step 2 - Set your generator's default to 20 characters. Every new signup gets a random string saved straight into your manager. Store it somewhere encrypted and searchable - A Password Wallet keeps generated credentials organized so "memorable" never has to mean "reused."
Step 3 - Convert stragglers opportunistically. Each time you manually type a password that isn't on your must-memorize shortlist, that's a signal: replace it with a generated one on the spot. No marathon migration required.
Step 4 - Respect the length floor either way. Whether string or phrase, undersized is undersized. The crack-time math behind the thresholds is laid out in how long should a password be - 16-plus random characters, or six-plus random words.
FAQ
Is a passphrase really as strong as a random password?
At typical lengths, a 16-character random string (~105 bits) outguns a six-word passphrase (~77 bits) on raw entropy. But both sit beyond realistic offline attack, and a passphrase you can actually memorize beats a string you write on a sticky note. Use the string where software remembers it, the phrase where your brain must.
Can I just use passphrases for everything?
You could - Six random words are strong enough for any account. It's simply pointless friction: for autofilled logins, the passphrase's one advantage (memorability) never gets used, while its lower per-character entropy and longer length remain. Since the generator and manager remove all cost from random strings, take the free extra margin.
What about the trick of turning a sentence into initials?
Taking My first car was a 1998 Civic with 200k miles! and compressing it to Mfcwa1998Cw2m! produces something better than the average human password but far worse than its length implies - Sentence structure leaks through, and attackers model mnemonic patterns too. It's a decent trick for a temporary password; it's not a substitute for dice.
Do I need symbols in a passphrase?
Only if a site's composition rules demand them - The strength comes from word count, not decoration. Appending a digit and capitalizing one word satisfies almost every checker without meaningfully changing memorability. Adding a symbol between words as a separator is fine too; just don't count it as significant extra entropy.
How many passwords should I actually memorize?
Two to four, for nearly everyone: the password-manager master password, your computer login, and possibly your primary email and phone unlock. Everything beyond that list is a job for generated strings and autofill. If you're memorizing ten passwords, eight of them are either reused or written down somewhere they shouldn't be.