Passphrase or random characters: which should you use?
A passphrase is several unrelated words strung together — sapling-sierra-cliff-dapper-widget-53. A random password is a run of characters with no structure at all. Both can be strong. They fail in different ways, and that is what should decide between them.
The strength comparison, honestly
Entropy comes from the size of the pool and the number of picks. A word drawn at random from a list of about seven hundred contributes roughly 9.4 bits. A character drawn from a 70-character set contributes about 6.1 bits. So six words is around 57 bits, and adding a two-digit number takes it to about 63. Twenty random characters is about 122 bits.
On paper the random password wins by a wide margin. In practice both are far past the point where anyone guesses them, so the number is not the whole story.
Why fewer bits can still be the safer choice
The realistic failure mode for a strong password is not that someone guesses it. It is that you could not remember it, so you wrote it on a note, reused one you already knew, or picked something weaker the next time because the strong one was inconvenient. A password you can actually recall removes all three.
Sixty-three bits is not a weak password. Against an online login, which rate-limits and locks out, it is untouchable. Against an offline attack on a stolen database it is still a serious amount of work. The gap between 63 and 122 bits only matters in scenarios where neither password would realistically fall.
Where passphrases fail
- Length limits. Six words is thirty-some characters. A site capping at sixteen will not take it.
- Character requirements. Many sites demand an uppercase letter, a digit and a symbol. The separator and a trailing number cover some of that, but not all.
- Words you chose yourself. A phrase you thought of is not random. Song lyrics, sayings and name-plus-year combinations are exactly what cracking dictionaries contain. The words must be picked by the generator.
- Typing them on a TV remote. Long is painful on a D-pad. Random characters are worse, but a short PIN or a shorter random password may fit better.
Where random characters fail
- You have to read them back. Copying twenty random characters onto another device by eye is where
l,I,1,Oand0cause real errors. Dropping look-alike letters fixes most of it. - You cannot memorise them. That is fine when a password manager holds them, and a problem when it is the password to the manager itself, or to your phone, or to an account you need on a device you have not set up yet.
Choosing per account
- Anything a password manager will hold: random characters, 16 to 20. You never type it, so there is no reason to trade strength for memorability.
- The handful you must know by heart: a passphrase. Your device unlock, your password manager's master password, your main email if you need to get into it from a borrowed computer.
- Wi-Fi: a passphrase works well. You read it aloud to guests and type it on TVs and consoles. Words survive that; random characters do not.
- Sites with strict rules: random, with the rules saved as a preset.
Two things that matter more than the choice
Never reuse either kind across sites, and never let a generator hand you something it derived from a seed you might reuse. A generated password is only as unpredictable as the source of randomness behind it — it should be the platform's cryptographic random number generator, not a shuffle seeded by the clock.
Lockmint
Lockmint makes both from the same screen. The recommended preset gives random characters; "easy to remember" gives six words from an offline list with your choice of separator and an optional trailing digit. Each result shows its strength in bits with a plain sentence explaining it, so you can see the trade-off rather than guess at it.