You have heard the advice: stop using passwords, use passphrases instead. Three or four random words strung together, easy to remember, hard to crack. It sounds like a free upgrade. But is a passphrase actually better than a traditional password? The honest answer is: it depends on what the secret protects and whether a human has to type it.
What makes any secret strong
Strength comes down to unpredictability, not length alone and not complexity alone. A secret is strong when an attacker cannot guess it faster than brute force would take, and brute force time grows with every unpredictable character or word you add. Sixteen truly random characters and five truly random words can both take centuries to crack. Eight characters of a pet’s name plus a birth year takes seconds, no matter how many exclamation marks you add.
The keyword is random. Human-chosen words and patterns are far more predictable than people believe, because attackers automate exactly the guesses humans make.
When a passphrase is the right call
Use a passphrase for the few secrets you must memorize and type regularly: the master password for your password manager, your laptop login, your phone unlock, your email account. These are typed daily, so memorability matters, and a passphrase like five random words is both memorable and strong. Dice-rolled or generator-picked words beat anything you invent yourself, because your brain has favorite words and attackers know it.
When a random password wins
Use a random string for everything else: every website account, every app, every service you log into through a password manager. You never type these, so memorability is worthless and only raw unpredictability counts. Sixteen to twenty random characters with letters, numbers and symbols is the standard, and a manager remembers them so you do not have to.
The setup that covers both
The winning combination is boring on purpose: a strong passphrase you memorize for your password manager and email, plus unique random passwords for everything stored inside the manager. The passphrase protects the vault; the random passwords protect the accounts. Neither job can be done well by the other kind of secret.
For the random side, do not invent them yourself. Open Trencada Password Generator, set the length to sixteen or more, and generate one unique password per account. They are created locally in your browser, so nothing sensitive is transmitted or stored.
The quick version
Memorize a passphrase for the three or four secrets you type every day. Generate random passwords for everything else and let a manager remember them. Start here: generate a strong random password.
