Passphrase vs Password: Which Is Stronger? (Free Tool)

A passphrase is several random words strung together, like walnut-ferry-tidal-oxygen-clamp-violin. A password is a string of random characters, like q7#Vd!m2Kp@x. Both can be equally strong: six random words from a big word list carry about the same strength as 12 random characters. Use random-character passwords from the free password generator for anything a password manager fills in, and a passphrase for the few things you must remember or type by hand.

The key word in both cases is random. A passphrase you choose yourself, like a song lyric, is weak; a passphrase picked by dice or software is strong.

The quick comparison

	Random password	Random passphrase
Looks like	q7#Vd!m2Kp@x	walnut-ferry-tidal-oxygen-clamp-violin
Strength comes from	Many possible characters per position	Many possible words per position
Typical strong length	16-20 characters	6-7 words
Easy to remember?	No	Fairly
Easy to type on a phone or TV remote?	No, lots of symbol switching	Yes, mostly lowercase letters
Accepted everywhere?	Almost; some sites cap length or ban some symbols	Some sites cap length below a long phrase
Best for	Everything stored in a password manager	Manager master password, computer login, Wi-Fi you type often

How strength is measured

Strength is counted in bits of entropy: each bit doubles the number of guesses an attacker might need.

• A random character from the generator's 85-character set (letters, digits and 23 symbols) adds about 6.4 bits.
• A random word from a list of 7,776 words (the size of the widely used diceware lists, where five dice rolls pick each word) adds about 12.9 bits.

So one random word is worth about two random characters. Some equivalents:

Passphrase	Bits	Similar random password
4 words (7,776-word list)	about 52	8 characters (about 51 bits)
5 words	about 65	10 characters (about 64 bits)
6 words	about 78	12 characters (about 77 bits)
8 words	about 103	16 characters (about 103 bits)

The maths only holds if each word is picked at random from the whole list. If you pick words yourself, you'll pick common, related words, and attackers' tools try exactly those combinations first. A smaller list also means fewer bits: with 2,000 words, each word adds about 11 bits.

For a sense of what these bit counts mean in time, see how long it takes to crack a password.

Where passwords win

• Inside a password manager. You never type or remember them, so make them long and fully random. 20 characters from all four character types is about 128 bits, far beyond any passphrase you'd want to type.
• Sites with short length limits. Some older sites cap passwords at 16 or 20 characters. Random characters pack more strength into fewer characters.
• API keys, service accounts and shared secrets. Machines don't care about memorability.

Where passphrases win

• Your password manager's master password. It's the one you must remember, and it protects everything else. Six or seven random words is a good target.
• Your computer or phone login, if you use a password there rather than a PIN or fingerprint.
• Anything typed on an awkward keyboard: smart TVs, game consoles, a Wi-Fi password guests type in by hand.
• Something you must read aloud, where quartz-lemon-harbor survives a phone call better than q7#Vd!m2.

As per NIST SP 800-63B (revision 4, 2025), long passwords and passphrases are welcome, sites should allow spaces and at least 64 characters, and shouldn't force composition rules or regular changes. Some sites still demand a capital, a digit and a symbol. Add them in one predictable place, such as Walnut-ferry-tidal-oxygen-clamp-violin-7. That doesn't add much strength, but it satisfies the rule without weakening the random words.

How to make each one

A random password: open the free password generator, set Length (it starts at 20 and goes from 8 to 128), keep Lowercase, Uppercase, Numbers and Symbols ticked, press Generate, then Copy. It's created on your device and never sent anywhere.

A random passphrase: the password generator makes character passwords only; it doesn't pick words. Two ways to get a random passphrase:

1. Dice. Use a published diceware word list and roll five dice for each word. Each roll picks one word from the 7,776. It's slow but completely offline.
2. Our random picker. Open the free random number generator, choose Pick from a list, paste a long word list (one word per line, the longer the better), set How many to pick to 6 and press Pick. It uses your browser's secure random source, and nothing is uploaded. Join the words with hyphens or spaces.

Whichever you choose, don't edit the result into something "nicer". Swapping a random word for a favourite one is how strength leaks away.

Common myths

"Passphrases are always stronger because they're longer." Length in letters doesn't matter; the number of random choices does. correcthorsebattery is 19 letters but only 3 random words, about 39 bits from a 7,776-word list, weaker than a random 8-character password.

"Replacing letters with symbols makes it strong." P@ssw0rd is one of the first guesses any cracking tool makes. Swaps like a→@ and o→0 are well known.

"I'll hash my password first to make it random." Hashing a weak password gives a long string, but an attacker who guesses your method can hash the same guesses. The free hash generator is for checksums, not for making passwords.

For a full routine, including how long a password should be for each kind of account, read how to create a strong password.

Generate one now

For every account your password manager handles, a random 16-20 character password is the strongest, simplest choice. Make one with the free password generator, copy it straight into your manager, and save passphrases for the handful of things you type yourself.