Passphrases vs. Random Passwords: NIST Changed the Rules. Here Are the Real Tradeoffs.
In 2017, the National Institute of Standards and Technology quietly killed 15 years of conventional wisdom about passwords. The guidelines it had published in 2003, which demanded mixed-case letters, numbers, and special characters, were replaced. NIST's new guidance acknowledged something that had become clear from nearly two decades of data: the complexity rules had not made passwords more secure. They had made users create predictable patterns, rotate through nearly identical credentials, and write down the passwords they couldn't memorize. The bad guys had adapted. The good guys had not.
The new question NIST's guidance raised -- and that security professionals have been arguing about since -- is which approach actually works: random character strings generated by machines, or passphrases assembled from multiple dictionary words? Both can be made secure. They make radically different tradeoffs in how they get there.
What Entropy Actually Measures
Password security is usually discussed in bits of entropy, which quantifies how many guesses an attacker would need to make, on average, before finding the correct password by brute force.
Entropy is calculated from the pool of possibilities. A single lowercase letter has about 4.7 bits of entropy because there are 26 letters (log2 of 26 is approximately 4.7). Each additional character, chosen randomly from the same pool, adds roughly the same amount. A 10-character password using the full set of 94 printable ASCII characters has about 65 bits of entropy. A 20-character random password using the same pool reaches approximately 131 bits.
Passphrases work from a different pool: words rather than characters. The EFF's standard Diceware wordlist contains 7,776 words. Each word drawn randomly from that list adds approximately 12.9 bits of entropy. A four-word passphrase yields roughly 51 bits. Five words yields about 64 bits -- comparable to a 10-character random password. Seven words reaches approximately 90 bits.
The math says both can reach any target entropy level. The difference is in how they get there and what the practical consequences are.
Where Passphrases Win
Memorability is not a cosmetic concern. A password you cannot remember must be written down or reused, and both behaviors reduce security more than a slightly shorter passphrase would. The human memory is structured to retain semantic meaning and narrative association, not arbitrary character strings. Passphrases are also easier to type accurately, which matters on mobile keyboards, on devices with different layouts, or in situations where autocorrect might modify an unfamiliar string.
There is also the question of human generation. If you ask 1,000 people to create a random-looking 12-character password without assistance, the results cluster heavily around predictable patterns -- certain substitutions, certain structures, certain numbers appended at the end. A 2019 analysis by Carnegie Mellon researchers found that user-chosen passwords conforming to complexity requirements had effective entropy far below what the character pool would theoretically allow.
By contrast, passphrases chosen at random from a wordlist are harder to game precisely because the selection must be genuinely random. An attacker who knows you use a passphrase still faces the combinatorics of a large wordlist raised to the power of however many words you used.
Where Random Character Passwords Win
At equivalent entropy targets, random character passwords are more compact. Achieving 128 bits of entropy requires approximately 20 characters chosen from a large pool, or approximately 10 randomly selected words. Twenty characters is fewer keystrokes in contexts where compactness matters.
More importantly, random character passwords resist dictionary-based phrase attacks. If an attacker knows a target uses a four-word passphrase from the EFF wordlist, they can construct a search space of roughly 7,776 to the fourth power -- still approximately 3.6 quadrillion possibilities, but a well-defined space. As passphrases have grown popular, purpose-built phrase cracking tools have emerged that target common wordlists systematically.
Random character passwords also avoid a subtle trap: the human tendency to select semantically meaningful words even when instructed to pick randomly. Purple mountain freedom launch sounds random but the words are ones humans find pleasing and are more likely to choose. True randomness is uncomfortable to humans, which means human-generated passphrases often have lower effective entropy than wordlist-generated ones.
How to Actually Choose
The comparison reduces to two questions: how will this credential be stored, and what is the threat model?
If the password will live in a password manager -- which is the right answer for most accounts -- the memorability advantage of passphrases is irrelevant. The manager stores either format equally well. A 20-character random string is perfectly suitable, and machine generation guarantees the randomness that human selection cannot.
If the password must be memorized and recalled reliably -- a master vault password, a device encryption key, a recovery code -- passphrases have a genuine advantage. Five to seven words from a large wordlist, selected by genuine random means, provides 64 to 90 bits of entropy while remaining feasible to commit to memory.
If the credential will be typed frequently on different devices and keyboards -- shared logins, two-factor backup codes, development environment credentials -- passphrases reduce error rates and frustration without meaningful security loss at the same entropy level.
NIST's 2017 guidance did not declare a winner between passphrases and random passwords. It declared a loser: forced complexity without length, and rotation policies that encourage predictable increments.
What Attackers Actually Do
Understanding how the attack actually works changes the tradeoff calculation in one important way. Real-world password cracking does not proceed character by character. Modern cracking tools -- Hashcat being the most cited -- work through curated wordlists first, then apply rule-based transformations (capitalize first letter, append numbers, substitute common symbols for letters), and only fall back to pure brute force when those approaches are exhausted.
This means that a password which was not generated randomly -- one that was constructed by a human who tried to be random -- is far more vulnerable than its character count suggests. The rule sets in tools like Hashcat systematically cover the substitutions and patterns that humans consider clever. P@ssw0rd1! is broken in seconds not because it is short but because it matches transformation rules applied to a wordlist entry.
Both passphrases and random character passwords, when genuinely randomly generated, force the attacker past the wordlist and rule phases into pure brute force. At that point, entropy is all that matters. Sixty-four bits is 64 bits, whether it comes from five words or ten characters. The format is a human usability consideration. The entropy is the security.
Conclusion
Whatever format you choose, length and genuine randomness are the variables that matter. For accounts that land in a manager, ToolHQ's Password Generator produces cryptographically random character strings of any length, entirely in your browser, with nothing sent to any server.
Frequently Asked Questions
What did NIST change about password rules in 2017?
NIST dropped mandatory complexity requirements (uppercase, numbers, symbols) and rotation policies. The new guidance focuses on length and randomness, and explicitly endorses passphrases as an alternative to traditional character-based passwords.
Are passphrases actually secure?
Yes, if generated randomly from a large wordlist. A five-word passphrase from the EFF Diceware list has about 64 bits of entropy, equivalent to a 10-character fully random character password. Seven words reaches 90 bits.
When should you use a random character password instead of a passphrase?
When the password will be stored in a manager rather than memorized, or when you need maximum entropy in minimum characters. Machine-generated random strings also guarantee true randomness that human word selection often fails to achieve.
What is Diceware?
A method of generating passphrases by rolling dice to select words from a standardized wordlist. The EFF's Diceware list contains 7,776 words, each corresponding to a unique five-die roll, guaranteeing genuinely random word selection.