Twenty years of password advice produced strings like Tr0ub4dor3 — hard for a human to remember, easy for a machine to guess. A passphrase flips that equation: several random words that are easy to type and memorise, yet take absurdly long to crack. The catch is that "random" has to mean genuinely random, and that is where most people go wrong.
The fastest way to get it right is a generator with a passphrase mode, such as pass.1mail.lt. It is free, runs entirely in your browser using crypto.getRandomValues, shows a live entropy meter as you adjust the settings, and sends nothing to any server — the phrase never leaves your device.
Here is the reasoning behind passphrases, the classic method for building one, and the mistakes that quietly ruin them.
Why length beats complexity
Strength is measured in entropy: the number of equally likely possibilities an attacker has to try. Swapping a for @ in a short password barely moves that number, because cracking tools apply the standard substitutions automatically. Adding a random word multiplies it.
The arithmetic is simple. The standard diceware list holds 7,776 words. One random word from it is one chance in 7,776. Two words: 7,776 × 7,776, roughly 60 million. Every additional word multiplies the attacker's work by 7,776 again, so by four or five words the total dwarfs anything an eight-character symbol jumble can offer — while staying far easier to remember and to type.
The diceware method
Diceware is the traditional way to do this. Roll five dice, look up the five-digit result in a numbered word list, write the word down, repeat. The dice make the choice, so your brain — with all its predictable habits — never gets a vote.
The practical rules:
- Use at least 4-5 words. Four is a sensible floor for ordinary accounts; take five or six for anything critical.
- Leave the words unmodified. The strength comes from how many random words there are, not from decorating them with digits.
- Separate with hyphens or spaces. It improves readability, and it satisfies sites that insist on a symbol.
A real example: copper-lantern-thirty-cactus. It means nothing, and that is precisely the point — the absence of meaning is the strength. A software generator with a proper random source does the same job as physical dice in one click: the passphrase mode at pass.1mail.lt picks the words locally on your device and its entropy meter shows exactly how much a fifth word adds.
What makes a passphrase weak
The classic failure is choosing words that already live in your head:
- Famous quotes and song lyrics. Attackers feed entire lyric databases and quote collections into their tools — even "correct horse battery staple" itself sits in every cracking dictionary by now.
- Personal facts. Pet names, birthdays, favourite teams: anything a stranger could scrape from your social media is a hint, not a secret.
- Keyboard-style substitutions. P@ssw0rd-type tricks add almost nothing, because a-to-@ and o-to-0 are the first mutations every tool tries.
- One passphrase reused everywhere. A single leaked database then opens every account you own.
The honest rule: if a phrase came out of your head, assume it is guessable. People reaching for "random" words converge on the same memorable patterns, which is why the generator, not you, must choose the words.
One passphrase per account, held by a manager
Nobody can memorise fifty unique passphrases, and nobody should try. The setup that works: a password manager stores a unique random password for every account, and one strong master passphrase — the only secret you actually memorise — protects the vault. Make the master five or six random words, type it deliberately for a couple of days, and it will stick for years.
Pair it with a second factor
Even an excellent passphrase can be phished on a convincing fake login page. Turn on two-factor authentication for your email, bank and password manager, preferably through an authenticator app rather than SMS. If those rotating six-digit codes are new to you, this guide to what a TOTP code is explains how they work and why they change every 30 seconds. It also helps to keep your main inbox out of low-value signups altogether — a temporary address from 1mail.lt covers those, so your real login circulates in fewer databases.
FAQ
How many words should a passphrase have?
Four random words is a reasonable minimum for everyday accounts. Use five or six for your password manager, your primary email and anything financial.
Is an online passphrase generator safe?
Yes, if generation happens in the browser. pass.1mail.lt uses crypto.getRandomValues locally and transmits nothing, so the phrase never touches a server.
Do I still need numbers and symbols?
Not for strength — the word count does the work. If a site demands them, use hyphen separators or append a digit; that satisfies the policy without changing the maths.
