Passphrase or Random Password: Which Should You Use?

The honest answer is that it depends on one question, and it is not the question people usually ask. It is not which is stronger. It is whether you will ever have to type the thing from memory. Almost everything else follows from that, and getting it backwards is why so much password advice feels contradictory.

Where a passphrase gets its strength

A passphrase built the right way draws words at random from a known list. The strength comes from the size of that list and the number of draws, and from nothing else. A common word list holds 7,776 entries, which is about 12.9 bits per word, so a six-word passphrase carries roughly 77 bits. That is genuinely strong, and you can memorise it, which is the entire point.

The mistake that undoes it

The strength depends on the words being chosen by a random process rather than by you. A phrase you invented is not four random words; it is a phrase, drawn from the far smaller set of phrases a human finds memorable, weighted towards words you happen to like. Attackers model that distribution, because it is cheap to do and it works. Song lyrics, film quotations and product names are all in the wordlists already.

A passphrase you thought of is not random. A passphrase you were dealt is.

Where a random password wins

Character-level randomness packs far more entropy into far less space. A sixteen-character password over a ninety-four character alphabet carries around 105 bits, comfortably beyond a six-word passphrase, in a fifth of the length. When something else is doing the remembering, density is free strength and there is no reason to leave it on the table.

six random words   ~77 bits    28 characters   memorable
16 random chars   ~105 bits    16 characters   not memorable

Length limits are the practical argument too. Plenty of systems silently truncate at a modest number of characters, and a truncated passphrase can lose most of its strength without telling you. There are still sites that reject spaces, which rules out the readable forms entirely.

A rule that resolves it

Use a random password everywhere a password manager will hold it, which should be almost everywhere. Reserve passphrases for the small number of secrets you genuinely have to type from memory: the password manager itself, a disk encryption key, a device login. That is usually three or four secrets in total.

• Manager-stored account: random, as long as the site permits.
• The password manager itself: a passphrase of six words or more, generated not invented.
• Full-disk encryption: a passphrase, since you must type it before anything else has started.
• Anything shared aloud or over the phone: a passphrase, because dictation of random characters fails.

Notice that under this rule the strength question barely matters. Both approaches clear the bar that counts, and the deciding factor is whether a human has to hold the secret in their head. Choose on that, generate it rather than inventing it, and the entropy takes care of itself.