Passphrase vs password: which is stronger and easier to remember?

How this is calculated

The strength of a passphrase depends on the word list size and the number of words. With a 7,776-word list (the EFF long word list), four words give 7,776^4 ≈ 3.66 × 10^15 combinations (about 51 bits of entropy). Five words give 7,776^5 ≈ 2.8 × 10^19 (about 64 bits). Six words give 7,776^6 ≈ 2.2 × 10^23 (about 77 bits). A six-word passphrase is stronger than any password a human could reasonably memorize. The downside: passphrases are longer to type and some sites still enforce character-class requirements (uppercase + lowercase + number + symbol) that passphrases don't meet without modification. Add a number and a symbol as a word separator or suffix to satisfy those requirements without sacrificing memorability.

Verdict

The EFF long word list at 7,776 entries gives four words about 51 bits of entropy, five words about 64, and six words about 77, which beats any password a human could memorize. The smaller 2,048-word four-word example is only 44 bits, so word-list size matters. The downside is length and site policy: character-class rules (uppercase plus number plus symbol) reject a plain passphrase, so a separator like a number or symbol satisfies both the rule and the readability. Random manager strings still win for accounts you never type.