Passphrases or random passwords?

Two shapes of secret

A random password is a string drawn from a character set: capital and lowercase letters, digits and symbols. It is designed to be pasted, never memorised — the perfect fit for anything a password manager or a configuration file will hold.

A passphrase is a handful of randomly chosen words joined by a separator. It is designed to travel through human beings: spoken over the phone, typed on a remote control, written on a piece of paper. Words are easier to hold in memory and easier to hear correctly.

Neither is "stronger" in the abstract. What decides is entropy and how the secret is used.

The maths, in one paragraph

For a random string, entropy is length × log₂(charset size). The full printable set gives roughly 6.5 bits per character, so a 20-character password is about 128 bits. For a word-based passphrase, entropy is words × log₂(list size): with the 7,776-word EFF list, each word is worth about 12.9 bits, so six words is roughly 77 bits. Both numbers assume the worst case — that the attacker knows exactly how you build your secrets and only has to guess the random choices.

What that maths does not survive is predictability. A passphrase built from a song lyric is worth almost nothing, however many words it has, because it was never random. The generator's re-roll button is free: use it.

Which to use where

• Website logins — random, 16–24 characters, all sets on, unique per site. Your manager fills them; you never see them.
• Password manager master password — passphrase, 6 words or more, because you have to remember it and type it often.
• Wi-Fi networks — either; a 24-character random string with ambiguous characters excluded, or a 5-word passphrase if guests and consoles need to type it.
• API keys, tokens and service accounts — random, as long as the service allows, often 32 or more characters. These are machine-to-machine and never typed.
• Full-disk encryption and device unlock codes — random, within the length the device supports, and stored somewhere that is not the device itself.
• Shared accounts — neither. A password shared between people cannot be kept secret for long; use individual accounts and permissions instead.
• PINs and phone passcodes — neither, strictly speaking: the device constrains you to digits. Follow the device's rules, enable biometrics, and know that a 6-digit PIN is not a substitute for a real password.

Three habits that beat both modes

• Never reuse. One leaked string must not open a second door. This is the single habit that prevents most account takeovers.
• Never store secrets in plain notes, chats or spreadsheets. If it must be written down, write it on paper and keep it somewhere you would keep a passport.
• Turn on two-factor authentication. It covers the case where the password itself leaks and you cannot act fast enough.

Reading the strength meter

The meter on the generator page shows estimated entropy in bits and a label. Treat it as a guide to the guessing space, not a verdict on your account: a 90-bit password is not much use if you reuse it on twenty sites, and a 60-bit passphrase stored in a locked drawer is usually a better decision than a 120-bit string pasted into a chat message.