Most of your passwords should be long, random strings generated and stored by a password manager. But a few passwords you must remember and type: your password manager’s master password, your computer login and perhaps your phone or email password. For these, a passphrase is often the best answer.
A passphrase is a password made of several words. Done well, it is long, hard to guess and easier to remember than a jumble of symbols. This guide explains how to create one.
Why Length Matters
Password strength depends heavily on how many possible combinations an attacker must try. Length increases that number dramatically. A long passphrase of several random words can be stronger than a short password with symbols, and easier to remember.
Current guidance from security organizations such as the National Institute of Standards and Technology emphasizes length and checking passwords against lists of known compromised passwords, rather than forcing frequent changes or complicated composition rules.
The Key Is Randomness
The words in a passphrase must be chosen randomly, not by you. Humans are bad at randomness: we pick song lyrics, quotes, names and patterns that attackers can guess. A phrase like a famous movie line is weak, even if long.
Random Word Methods
One well-known method uses dice and a numbered word list. You roll dice to pick each word, so the choice is truly random. Many password managers also include passphrase generators that pick random words for you.
How to Create a Passphrase
- Use a generator or dice method to pick several random words
- Aim for more words for more important accounts, such as your master password
- Separate words with spaces, hyphens or another character if you like
- Do not rearrange words to make them more meaningful
- Practice typing it several times
- Write it down once and store it securely until memorized, then decide whether to keep the copy in a safe place
Adding Numbers and Symbols
Some sites require numbers, capitals or symbols. Add them in a simple way, such as capitalizing one word and adding a number between words. The randomness of the words provides most of the strength.
Where to Use Passphrases
- Password manager master password
- Computer login
- Phone backup and email account, if typed often
- Wi-Fi network password. See home Wi-Fi security.
For everything else, let your password manager generate random passwords. See the password manager guide.
What to Avoid
- Personal information: names, birthdays, pet names, addresses, sports teams
- Common phrases, lyrics or quotes
- Keyboard patterns
- Reusing a passphrase on multiple sites
- Small variations of an old password
Do You Need to Change Passwords Regularly?
Many experts now advise against forced periodic changes for strong, unique passwords, because frequent changes lead to weaker patterns. Change a password if a site is breached, if you suspect compromise or if you reused it.
Checking for Breaches
Many password managers and browsers alert you when saved passwords appear in known breaches. If a password is flagged, change it on that site and anywhere you reused it.
Combine with Two-Factor Authentication
Even a strong passphrase can be phished. Two-factor authentication adds protection. See two-factor authentication setup.
Common Mistakes
- Choosing words yourself instead of randomly
- Using too few words
- Reusing a passphrase
- Storing the master password inside the vault it protects
A Note on Password Hints and Security Questions
Security questions are often weak because the answers, such as your first school or mother’s maiden name, can be found online. Where sites require them, treat answers like passwords: give random answers and store them in your password manager. Avoid password hints that reveal the password.
A Note on Writing Things Down
Security advice used to say never write passwords down. A more practical view is that a written note kept somewhere physically secure at home is far safer than a weak or reused password. The main risks with written passwords are people with physical access, so store any written record carefully.
Questions to Ask Yourself
- Which passwords do I actually type from memory?
- Are any of them reused anywhere?
- Is my master password long enough?
- Do I have two-factor authentication on my most important accounts?
Starting Small
Start with your password manager master password and email password. Once those are strong, move on to the rest with generated passwords.
A Note on Device PINs
Your phone PIN protects everything on the device, including saved passwords, email and passkeys. Use a longer PIN or an alphanumeric passcode rather than a short, guessable one, and avoid patterns or birthdays. Biometrics are convenient, but the PIN is the fallback that matters.
Comparison Table
| Password type | Best for | How to create |
|---|---|---|
| Random passphrase | Passwords you type | Dice or generator |
| Random string | Everything else | Password manager |
| Device PIN | Phone unlock | Longer, non-patterned |
| Security answers | Account recovery | Random, stored in manager |
Final Passphrase Checklist
- Words chosen randomly
- Enough words for the account’s importance
- Not reused anywhere
- Practiced until comfortable
- Stored securely until memorized
Frequently Asked Questions
How many words should a passphrase have?
More words mean more strength. For a master password, err on the longer side.
Are spaces allowed?
Many systems allow them; others require a different separator.
Is a passphrase better than a random password?
For passwords you must remember, often yes. For others, random generated passwords are fine.
Should I write down my passphrase?
Writing it down once and storing it securely can help until memorized.
Can I use the same passphrase for my computer and password manager?
It is better to use unique passphrases.
The Bottom Line
Use random-word passphrases for the few passwords you must remember, let a password manager handle the rest, avoid personal information and add two-factor authentication.
Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.