Are passphrases actually stronger than passwords?

Ask whether a passphrase is stronger than a password and the answer you get is usually a confident yes with a comic strip attached. The comic is right, and it is right for a narrower reason than most people take from it. A passphrase is not stronger because it has spaces in it or because words are friendlier than symbols. It is stronger when, and only when, the words were drawn from a list rather than chosen by a person. Get that wrong and you have a long password with a false sense of security attached.

The question is badly put

Both things are strings. The site receiving one does not know or care which word you used for it. What determines strength is the size of the space the string was drawn from and how confident an attacker can be that you drew from it — which is exactly the entropy calculation from the previous piece, applied to a different alphabet.

For a random password the alphabet is characters and the arithmetic is length times bits per character. For a generated passphrase the alphabet is a word list and the arithmetic is the number of words times bits per word, where bits per word is the base-two logarithm of how many words were in the list.

H = W x log2(N)

W  how many words are in the phrase
N  how many words were in the list it drew from

The number that does the work is N, and it is the number nobody thinks about. A list of a thousand words gives about ten bits per word. A list of eight thousand gives about thirteen. That is a twenty-five percent improvement in strength per word for a list that is eight times larger — which tells you something about how slowly this scales, and also about why the size of the list you draw from is the only part of passphrase advice worth arguing about.

What that buys you in words

Multiply the per-word figure by the length of the phrase and you have a comparable number to the ones a password generator shows. The table below does the multiplication across the four list sizes.

Every figure is bits of entropy. Read across the 7,776-word row and the numbers land where you would expect: six words is 77.6 bits, which is a shade under a twelve-character password drawn from the full 95-character set, and considerably better than a fifteen-character one that uses only lowercase letters.

Now read down the four-word column instead. Four words from a small list is 41.4 bits. At a hundred billion guesses per second that is a matter of seconds. Four words from a large list is 51.7 bits, which is roughly five hours. That is the whole problem with the shape of passphrase advice on the internet — the advice is usually correct about the technique and silent about the parameter, and the parameter is the difference between an afternoon and a geological era.

The comic that made passphrases famous gave correcthorsebatterystaple a score of about 44 bits and the password Tr0ub4dor&3 a score of about 28. Forty-four bits is exactly what four words from a 2,048-word list comes to. Both numbers were honest — the comic was comparing a generated phrase to a badly chosen word, and it picked a phrase length that would not pass muster today.

The phrase you invented is the problem

Here is the part that gets skipped. correcthorsebatterystaple is now in cracking dictionaries as a single entry. It is famous, it appeared in a popular comic, and password cracking tools ship wordlists built from exactly that kind of cultural material. An attacker who has that string in a list does not need to search the space at all.

The same is true at a smaller scale for anything a person composes from memory. Human-chosen phrases draw on a vocabulary of a few thousand words with wildly uneven probabilities — love, sunshine, dragon and coffee appear far more often than cactus or pelican. Uneven probabilities are what make the effective list smaller than the number of words you know. A phrase built from a mental list of two thousand words, with the common ones used more often, is worth far less than the arithmetic above suggests, and there is no way to estimate by how much.

A generated phrase and an invented phrase are the same shape and completely different strength. Only one of them has a number attached.

Where a passphrase loses

Nothing above is an argument that passphrases should replace generated passwords. They solve a specific problem — a secret you have to carry in your head — and they are worse than a random string at everything else. The honest list of drawbacks:

• They are long to type. A six-word phrase runs past forty characters. On a phone keyboard with autocorrect that is a genuinely annoying amount of typing, and inconvenience is how people end up reusing things.
• Some systems mangle them. Plenty of signup forms still refuse spaces, cap the length, or demand a digit and a symbol. Truncation is the dangerous one: it happens silently, so your forty-character phrase may be stored as its first twelve characters and nothing will tell you.
• bcrypt has a hard limit. The algorithm truncates input at 72 bytes. Words are longer than characters in bytes as soon as you use anything outside basic ASCII, and a long phrase can cross that line without anyone noticing. Modern password hashing — Argon2id in particular — has no such limit, but you do not get to choose what a site uses.
• Every word is a common word. If someone watches you type, a phrase leaks more per keystroke than a random string does — the first two letters of pelican narrow it a long way, and the same is not true of x7.
• Autocorrect learns them. A phone keyboard that has watched you type the same phrase fifty times will start suggesting it, and on some phones those suggestions sync to a cloud account.

The rule I would use

1. One generated phrase, memorised, for the vault. Six words from the largest list your generator offers, never typed anywhere except the vault, and never reused as anything else. At 77.6 bits it is not the strongest secret you own — that will be one of the generated ones — but it is strong enough that guessing it is not the cheapest way in.
2. Generated characters for everything else. Twenty characters, full set, stored by the manager and never seen by you. There is no reason to make an account password memorable, and every reason not to.
3. Two-factor on the vault itself. The master password protects everything behind it, so it is the one account where a second factor is not optional. It is also the account where losing access hurts most, so keep the recovery codes somewhere that is not the vault.
4. Generate the phrase, do not compose it. If you find yourself reaching for words that mean something to you, that is the signal that you are inventing rather than generating, and the arithmetic above no longer applies.

What to take away

A passphrase is a fine idea executed badly most of the time. The technique is sound: draw words at random from a list you did not choose, take at least six of them, and use the result in exactly one place. The failure is always in the same spot — people pick the words themselves, pick four of them, and end up with something that reads as strong and computes as weak. Length is doing the work either way, and the list the length came from is doing the rest.