Making strong secrets · 5 min read

How many words should a passphrase have?

It depends on whether an attacker can guess offline. Four random words resist online guessing; five or six are the usual floor for secrets that might face an offline attack.

There is no single right number of words. What decides it is how fast an attacker could guess, which depends on where the passphrase is used and how the thing it protects is stored. This guide works through the numbers for words drawn at random from the EFF large wordlist (7,776 words), the list this site’s generator uses.

Each word is worth 12.925 bits

One word picked uniformly from 7,776 is log2(7,776) = 12.925 bits. Words are chosen independently, so the bits add: four words is 51.70, five is 64.62, six is 77.55. Every extra word multiplies the attacker’s work by 7,776.

These figures hold only if the words were chosen at random, by dice or a proper generator, and an attacker is assumed to know the list and the word count. If you picked the words yourself, see random vs human-chosen passwords.

Three attack speeds

How long those bits last depends on the guessing rate. This site uses three illustrative rates throughout. They are order-of-magnitude assumptions, not measurements of any particular attacker:

• Online, rate-limited. The attacker has to try each guess against the live service. NIST SP 800-63B-4 requires verifiers to limit consecutive failed attempts on an account “to no more than 100” before disabling that authenticator, so in practice the number of tries can be far lower than even this rate implies.
• Offline, slow hash. The attacker has a stolen copy of a password hash made with a deliberately expensive function, and guesses on their own hardware.
• Offline, fast hash. The same, but the hash was cheap to compute, so guessing is millions of times faster.

You usually don’t know which of these applies to a given website, which is why the offline cases matter.

The table

Worked example: four words versus six

Four words give 7,776^4 = 3,656,158,440,062,976 possibilities (51.70 bits). On average an attacker searches half: about 1.83 × 10^15 guesses.

• Online at 100 guesses per hour: 1.83 × 10^15 ÷ 100 hours, roughly 2 billion years. Four words are far more than enough against online guessing alone.
• Offline, slow hash at 10,000 per second: 1.83 × 10^15 ÷ 10^4 seconds, about 5,800 years.
• Offline, fast hash at 10^11 per second: 1.83 × 10^15 ÷ 10^11 = 18,280 seconds, about 5.1 hours.

Six words give 7,776^6 ≈ 2.21 × 10^23 possibilities (77.55 bits). The average search is about 1.1 × 10^23 guesses.

• Offline, fast hash at 10^11 per second: about 1.1 × 10^12 seconds, roughly 35,000 years.
• Offline, slow hash: about 3.5 × 10^11 years.

The jump from four words to six multiplies the work by 7,776^2 = 60,466,176. That is why a passphrase that would fall in an afternoon against a fast hash becomes impractical to brute-force with two more words.

Reading the result

A rough guide, using the averages above:

EFF’s dice page says: “For most applications, we suggest making a six-word passphrase,” and “We recommend selecting a minimum of six words from our long wordlist.” Its deep dive calls six words “a strength of 77 bits of entropy” and notes each additional word adds “about 12.9 bits.”

When to go higher

Use more words when an attacker could get a copy of the protected data and take as long as they like, with no server to slow them down:

• the master password for a password manager vault (choosing a master password);
• full-disk or file encryption;
• an encryption key’s passphrase.

In those cases nothing rate-limits the guessing except the key-derivation function the software uses, and you may not know how expensive it is. Six or seven words leave a wide margin.

When fewer is acceptable

For a login where the service enforces lockouts and stores passwords properly, four random words are already far beyond online guessing. The weak point is the service’s storage. If its database leaks and it used a fast hash, four words could fall within hours by the figures above. Because you can’t inspect how a site stores passwords, many people use five or six words anyway, or let a password manager generate a long random password for sites they never type by hand.

NIST’s 15-character minimum for single-factor passwords is not a constraint here: with words averaging 7.0 letters, even three EFF words usually exceed it. Length in characters is not the measure that matters for a passphrase, though; the number of randomly chosen words is.

What doesn’t change the count

• Longer words. The bits come from the list size and the word count, not the letters. A phrase of long words and one of short words from the same list are equally strong.
• Separators and fixed capitalization. A hyphen or capitalizing every word is a fixed rule an attacker applies too.
• Adding a digit or symbol. The generator’s options add 5.907 or 5.585 bits for a six-word phrase. Helpful for sites that demand them, but less than half of what one more word adds.

Note: All times here are averages over a uniform random choice under assumed rates. The crack-time calculator lets you change the rate and see the effect, and how long it takes to crack a password explains the assumptions in more depth.

Try different word counts in the passphrase generator; it shows the bits for every setting.

General explanation, not advice for a particular situation. Updated 2026-10-31.