What Is a Passphrase? Diceware and Word-Based Passwords

The best password you'll ever memorize probably looks like crouton-velvet-mustang-ripple-fog. That's a passphrase: a password assembled from words picked at random from a large list, rather than from random characters. The idea was popularized by Arnold Reinhold's Diceware method in 1995 and then immortalized by an xkcd comic ("correct horse battery staple"), but it isn't a joke or a shortcut - The math is rigorous, the security is provable, and for anything you have to remember or type by hand, a passphrase is usually the right tool. The catch, and it's the one thing people get wrong, is that you don't get to pick the words.

Passwords versus passphrases

Both are just secrets measured in entropy - The number of possibilities an attacker must search. A random character password draws each position from ~95 printable characters (about 6.6 bits per character). A passphrase draws each position from a wordlist of thousands of words. With the EFF's standard long list of 7,776 words, each word is worth log₂(7776) ≈ 12.9 bits.

That single difference changes the human experience entirely. Sixteen random characters (k7#mQ!vX2p$wR9zL, ~105 bits) are miserable to memorize and worse to type on a phone. Six random words (maple oxide thrift canyon jubilee waffle, ~77.5 bits) can be learned in a day and typed anywhere - And 77 bits is far beyond what any GPU rig can search, as the crack-time math in password entropy explained shows.

The Diceware method, step by step

Diceware earns trust because it needs no software at all - Physical dice are a perfectly auditable random number generator.

1. Get the wordlist. The EFF long wordlist contains 7,776 words (that's 6⁵), each indexed by a five-digit code of numbers 1–6, chosen to be common, distinct, and easy to spell.
2. Roll five dice (or one die five times). Read them in order - Say, 3-1-4-2-6 - And look up word 31426.
3. Repeat for each word. Five words for everyday memorized secrets, six for a password manager master password, seven or more for encryption keys that must survive offline attack for decades.
4. Keep the result exactly as rolled. No swapping a word you dislike, no rerolling until it "feels right" - Every human veto leaks entropy.
5. Add a separator (hyphens, spaces) and, if a site demands it, a capital letter and digit. These satisfy legacy complexity rules without changing the security story.

No dice handy? A passphrase generator that uses the browser's cryptographic random source performs the same draw from the same wordlist instantly. What makes either method sound is the sampling process, not the ritual - Dice and CSPRNGs are interchangeable here, and how random password generators actually work explains why the browser's crypto API is trustworthy for this.

Why you can't pick the words yourself

The entire security claim rests on uniform random selection. 7,776⁶ six-word combinations ≈ 2.2 × 10²³, and Diceware guarantees yours was equally likely to be any of them. The moment a human chooses, the space collapses: people pick concrete, pleasant, related words - The mental image of a horse, a battery, a staple - And cracking tools run combinator attacks that pair common words precisely because of this. A "passphrase" like iloveparisinspring is four words an attacker's phrase dictionary already contains in sequence. Song lyrics and movie quotes are worse; entire corpora of them ship with cracking tools.

A passphrase is strong because of how it was chosen, not how it looks. Dice you rolled: strong. Words you thought of: a dictionary attack waiting to happen.

The same logic explains why familiar-looking passwords dominate breach dumps year after year - See the most common passwords for how predictable human choices really are.

Where passphrases fit (and where they don't)

Passphrases excel exactly where random character strings fail - Secrets that pass through a human brain or fingers:

• Password manager master password - The one secret that unlocks all others, which you must memorize and can never store anywhere. Six words minimum.
• Operating system and laptop logins, typed many times a day.
• Full-disk encryption (FileVault, BitLocker, LUKS) - An offline-attack target, so go to seven words.
• Wi-Fi networks - WPA keys get typed once per guest, often on awkward TV and phone keyboards, and are subject to offline cracking of captured handshakes. A word-based key from a Wi-Fi password generator is both strong and shareable aloud.
• Anything you might have to read over the phone or type on a console with no clipboard.

For the other two hundred accounts in your vault, memorability buys you nothing - A manager autofills either way - So random 16+ character strings are at least as good there. The practical division of labor: one memorized passphrase unlocking a vault of generated passwords; our password manager guide covers setting that up. And for the identifiers that aren't secret, random words work too - A word-pair handle from a username generator keeps accounts unlinkable across sites without burning your real name.

How strong is strong enough?

• Four words (~52 bits): fine for online accounts behind rate limiting; thin against offline GPU attack on a fast hash.
• Five words (~65 bits): solid for most memorized uses.
• Six words (~77 bits): the standard recommendation for master passwords - Beyond any current cracking capability even against fast hashes.
• Seven+ words (~90+ bits): archival-grade; appropriate for encryption keys where the ciphertext could be attacked offline for decades.

For calibration: at a trillion guesses per second - A serious multi-GPU rig against a fast hash - Searching half of the six-word space takes on the order of three and a half thousand years. Under a slow hash like bcrypt or Argon2, multiply by another factor of a million or so. The words being public knowledge doesn't help the attacker; the wordlist was always assumed known. Only the rolls are secret.

FAQ

How many words should my passphrase have?

Five for everyday memorized secrets, six for a password manager master password or anything high-value, seven or more for disk encryption and long-lived keys. Each EFF-list word adds about 12.9 bits, so the jump from five to six words multiplies an attacker's work by nearly 8,000.

Is "correct horse battery staple" from the xkcd comic safe to use?

The method it illustrates is excellent; that exact phrase is now one of the most famous strings on the internet and sits in every cracking wordlist. The comic's real lesson is that four randomly chosen words beat a mangled dictionary word - But the words must be freshly rolled, not copied from anywhere, including examples in articles like this one.

Do I need real dice, or is a generator okay?

Either works. Physical dice are auditable and need no trust in software; a generator backed by a cryptographically secure random source (like the Web Crypto API) samples the same wordlist with the same uniformity. What matters is that the selection is uniform and secret - What breaks the method is picking words mentally or editing the result.

Should I add numbers and symbols to a passphrase?

Only when a site's legacy rules force it - Append a digit and capitalize a letter and move on. Substituting characters inside the words adds almost no entropy against rule-based cracking. The honest way to strengthen a passphrase is another word, worth ~13 bits, versus a bit or two for decoration.

Can I use a favorite quote or song lyric as a passphrase?

No. Quotes, lyrics, verses, and sentences you compose follow language statistics and appear in phrase dictionaries that cracking tools ship with. A real passphrase's words are independent random draws with no grammatical or thematic connection - That independence is where the entropy comes from.