Making strong secrets · 5 min read

How passphrases work

A passphrase is several words chosen at random from a known list. Its strength comes from the size of the list and the number of words, not from the words being secret.

A passphrase is a password made of several words. The kind this site generates is a specific, narrower thing: a handful of words drawn at random from a published list. That one detail, who or what does the choosing, decides almost everything about how strong it is.

The idea in one paragraph

Take a list of 7,776 words. Pick one word uniformly at random, so every word has the same chance. Do it again, independently, five more times. The result might read panoramic nectar precut smith banana handclap, which is the example on EFF’s own dice page. An attacker can know the list, know that you used six words, and know the method. What they cannot know is which of the possible combinations you landed on, and there are a great many of them.

Counting the possibilities

With a list of n words and k words in the phrase, the number of possible passphrases is n multiplied by itself k times, written n^k. The EFF deep dive puts it the same way: “for k words chosen from a list of length n, there are n^k possible passphrases,” and an attacker needs “about n^k/2 guesses on average.”

For the EFF large wordlist, n = 7,776, which is 6^5, the number of ways five six-sided dice can land.

Worked example: six words

• One word: 7,776 possibilities. In bits, log2(7,776) = 12.925 bits.
• Six words: 7,776^6 = 221,073,919,720,733,357,899,776 possibilities.
• In bits: 6 × 12.925 = 77.55 bits.

That 24-digit number is the same one EFF prints under its example (“one of 221073919720733357899776 (or about 2⁷⁷) alternatives”). An attacker who tries combinations in some order will, on average, find yours about halfway through: roughly 1.1 × 10^23 guesses.

Each extra word multiplies the count by 7,776 and adds 12.925 bits. Each word removed divides it by 7,776. The entropy guide explains why bits are the convenient unit, and how many words you need turns these counts into time.

Why words, rather than random characters?

Strength per character is lower with words, but strength per unit of memory is higher. A random printable character is worth log2(94) = 6.555 bits, so 77.55 bits of random characters is about 12 characters like k#9Vq!2mR@xe. Most people find six ordinary words easier to hold in their head and to type correctly than twelve unrelated symbols, even though the words are longer on screen.

The EFF large list was built for this. According to its author, the words are between 3 and 9 letters, were chosen for being familiar and concrete, had hard-to-spell words and homophones removed, and “no word is an exact prefix of any other word.” The average word is 7.0 letters, so a six-word phrase with spaces runs about 47 characters.

What makes it strong, and what doesn’t

The randomness is doing the work. The words themselves are ordinary and public. If you pick words yourself, even unusual ones, you are no longer drawing uniformly from 7,776 options; people favor some words, some orders, and grammatical sentences. The math above stops applying, and nobody can tell you what replaces it. See random vs human-chosen passwords.

The separator doesn’t add strength. A space, hyphen, period or nothing between words is a fixed choice an attacker can try in a handful of extra guesses. Because no EFF word is a prefix of another, panoramicnectar can only be split one way, so dropping the separator doesn’t lose strength either. Pick whatever the site accepts and you can type reliably.

Optional extras add a little, and the amounts are countable. This site’s generator offers a few, and each is computed from the setting rather than guessed:

Compare these with simply adding a seventh word: +12.925 bits. The extras exist mostly for sites that insist on a digit or a symbol. They do no harm, but an extra word is the more effective lever.

Capitalizing the first letter of every word adds nothing, because it is a fixed rule. The attacker applies it too.

Where passphrases fit

Passphrases shine wherever you have to remember and type a secret: the master password of a password manager, a computer login, disk encryption. EFF’s page lists exactly these uses and recommends a six-word phrase from its long list for most of them. For the dozens of website logins you never type by hand, a password manager can store a long random password per site, and memorability matters less.

NIST’s current guidance supports long phrases from the verifier’s side. SP 800-63B-4 says verifiers “SHOULD permit a maximum password length of at least 64 characters” and should accept the space character along with all printing ASCII characters, and its Appendix A notes that “the use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password.”

Note: A passphrase’s strength protects you against guessing. It does nothing against phishing, a keylogger, or reuse across sites. If the same phrase is used on two services and one leaks, the strength of the phrase no longer matters.

A practical checklist

1. Let something random choose the words: dice (how to do it by hand) or the passphrase generator, which uses your browser’s cryptographic random number generator.
2. Don’t reroll because you dislike a word. Each reroll you do on taste nudges the result away from uniform.
3. Use enough words for where the phrase will live; six is EFF’s default for important uses.
4. Keep the words in the order they were drawn.
5. Use the phrase in one place only.

The full list, with the five-dice number beside each word, is on the wordlist page.

General explanation, not advice for a particular situation. Updated 2026-10-31.