Question 1

What is a passphrase and how is it different from a password?

Accepted Answer

A passphrase is a sequence of words (e.g., 'correct horse battery staple') used as an authentication credential. Unlike traditional passwords that combine random characters, passphrases leverage the human ability to remember sequences of familiar words while maintaining high entropy through the number of words chosen. A 4-word passphrase from a 7776-word wordlist provides ~51 bits of entropy; 6 words provides ~77 bits. The key advantage is memorability — humans remember word sequences far better than arbitrary character strings, reducing the temptation to write down or reuse passwords.

Question 2

What is Diceware and how does it work?

Accepted Answer

Diceware (invented by Arnold Reinhold in 1995) is the original method for generating secure passphrases by rolling physical dice. You roll 5 dice and look up the resulting 5-digit number in a standardized 7776-word list (6⁵ = 7776). The randomness comes from genuine physical dice rolls — not a computer. For digital generators, the same wordlist is used but with a CSPRNG (crypto.getRandomValues) replacing the dice. The entropy per word is log2(7776) ≈ 12.9 bits, so a 6-word passphrase has ~77 bits of entropy — strong enough for most purposes.

Question 3

How many words do I need for a secure passphrase?

Accepted Answer

Security guidelines suggest: 4 words (~51 bits) for low-sensitivity use (local device unlock). 5 words (~64 bits) for general purpose (email, non-financial accounts). 6 words (~77 bits) for high-security accounts (banking, password manager master password). 7-8 words (~90-103 bits) for long-term secrets and high-value accounts. The 6-word recommendation is widely cited because it exceeds the 72-bit threshold considered secure against offline attacks with current hardware. Beyond 8 words, the additional security margin rarely justifies the memorization burden.

Question 4

Is a passphrase more secure than a random character password?

Accepted Answer

It depends on length and entropy. A 6-word Diceware passphrase has ~77 bits of entropy — equivalent to a truly random 13-character password using an 80-character pool. Both are strong for most purposes. The real security advantage of passphrases is behavioral: users who must remember credentials are less likely to reuse passphrase-protected accounts and less likely to write down a memorable word sequence. For stored/machine-generated secrets like API keys, random character strings are preferred for compactness.

Question 5

Can I customize a passphrase with numbers and symbols?

Accepted Answer

Yes, but additions must be truly random to count toward entropy. Appending a random number (e.g., '42') or symbol after a passphrase adds log2(100) ≈ 6.6 bits if chosen from 100 possibilities. However, adding predictable elements like substituting 'a' with '@' provides almost no security benefit since attackers test these substitutions. Many systems require symbols; the most secure way to meet such requirements is to add a randomly selected symbol and digit at a random position, then memorize that addition. Alternatively, use a password manager to store the generated passphrase and forget about the character requirements.

Secure Passphrase Generator

Frequently Asked Questions

Code Implementation

Comments & Feedback