Passphrase vs password: which is stronger and easier to remember?

Use passphrases for passwords you need to remember and type (master password, computer login, disk encryption). Use random passwords from a password manager for everything else. A 4-5 word passphrase is both memorable and strong enough for most threat models.

A password is a short string of mixed character types (like Kx9$mQ2!pR). A passphrase is a sequence of random dictionary words (like correct-horse-battery-staple). Passphrases are easier to remember and type, and with enough words, they're stronger than passwords. The famous XKCD comic got the math right: four random words from a 2,048-word list give 2,048^4 = 1.76 × 10^13 combinations, equivalent to a random 8-character password with mixed character types.

By TechCompare · Updated August 2026

Security domain

Best Practices

Practical password security advice

Topic focus

Passphrase vs password

passphrase-vs-password

How this is calculated

The strength of a passphrase depends on the word list size and the number of words. With a 7,776-word list (the EFF long word list), four words give 7,776^4 ≈ 3.66 × 10^15 combinations (about 51 bits of entropy). Five words give 7,776^5 ≈ 2.8 × 10^19 (about 64 bits). Six words give 7,776^6 ≈ 2.2 × 10^23 (about 77 bits). A six-word passphrase is stronger than any password a human could reasonably memorize. The downside: passphrases are longer to type and some sites still enforce character-class requirements (uppercase + lowercase + number + symbol) that passphrases don't meet without modification. Add a number and a symbol as a word separator or suffix to satisfy those requirements without sacrificing memorability.

Verdict

The EFF long word list at 7,776 entries gives four words about 51 bits of entropy, five words about 64, and six words about 77, which beats any password a human could memorize. The downside is length and site policy: character-class rules (uppercase plus number plus symbol) reject a plain passphrase, so a separator like a number or symbol satisfies both the rule and the readability. Random manager strings still win for accounts you never type.