Password security guide
Password vs Passphrase
Use a random character password for accounts a manager can fill. Use a randomly generated multi-word passphrase when you must remember or type the credential.
Password and passphrase comparison
| Property | Random password | Random passphrase |
|---|---|---|
| Typical format | Characters from a configured pool | Independent words from a defined list |
| Best use | Stored account credentials | Master credential or manual entry |
| Compactness | High strength per character | Longer for a similar search space |
| Memorability | Low | Higher with practice |
| Compatibility | Usually broad when pool is adjusted | Long length and separators can be rejected |
What makes a random password strong?
A cryptographic generator selects every character independently from the allowed pool. Its search space can be calculated from pool size and length. A 20-character result stored by a manager is compact, unrelated to personal facts and easy to replace per account.
Do not memorize dozens of random strings. The vault exists to remove that pressure and prevent reuse.
What makes a generated passphrase strong?
The words must be selected independently from a documented list. The list is public; secrecy of the list is neither expected nor required. With the EFF 7,776-word list, each selected word represents one of 7,776 choices.
A self-invented sentence is not generated. Grammar, cultural references, personal facts and common word pairings reduce the effective search space.
Which is better for a password-manager master credential?
A random passphrase can be easier to remember and enter on new devices. Choose enough independent words for a strong margin, follow provider limits, and avoid modifying the output into a familiar sentence. Practice the exact phrase without storing it in insecure notes.
Keep recovery material separate and test account recovery before an emergency. A forgotten master credential may be intentionally unrecoverable depending on the manager design.
Which is better for ordinary website accounts?
A random character password is usually better because a password manager fills it automatically. It reaches a large search space with fewer characters and can be tailored to restrictive policies. Make it unique even when two sites share the same requirements.
A passphrase remains a valid option where a service accepts its length, but there is little usability benefit if you never type it.
Separator, capitalization and symbol myths
A fixed separator such as a hyphen improves readability but adds no random choice. Deterministic capitalization adds no uncertainty. A randomly chosen separator or extra character contributes only the size of its actual choice set.
Do not advertise a passphrase as stronger merely because it contains punctuation. Word count, selection method and uniqueness carry the claim.
Account threats neither format solves
Both formats can be phished, captured by malware, exposed through unsafe recovery or reused. Both need MFA, secure storage and a trusted device. A passkey can remove the shared secret from supported sign-ins, though recovery and device access still need planning.
Decision checklist
- Will software store and fill the credential? Choose a random password.
- Must you remember and manually enter it? Consider a random passphrase.
- Does the service reject spaces or long input? Use a compatible generated password.
- Is this a shared credential? Prefer individual identities and managed sharing.
- Can the service use a passkey? Evaluate that option and enroll safe recovery methods.
Examples of appropriate use without publishing real secrets
For a shopping account, generate a random character password and let the manager fill it. For a vault master credential, generate independent words and practice the exact phrase. For a Wi-Fi network, follow the router passphrase limits and consider a long printable random value. For a disk-encryption recovery key, use the format and storage process supplied by the product rather than inventing a phrase.
Published examples should demonstrate structure only. Never copy a sample phrase from an article, documentation page or screenshot, because it is public by definition.
Typing, accessibility and international keyboards
A passphrase can reduce errors when a credential must be entered with assistive technology or on devices without synchronized autofill. Plain words and a consistent separator may be easier than visually similar characters. The required word count must still provide an adequate random space.
Random character passwords can avoid language and word-list concerns, but symbols move between keyboard layouts. Exclude ambiguous characters or use a service-compatible ASCII pool for credentials that will be transcribed. Accessibility should shape the generated format, not force reuse or predictable selection.
Passphrase questions
Are spaces safe in a passphrase?
They are valid random separators when the service accepts them, but some systems trim leading or trailing spaces or reject them. A fixed separator does not add entropy.
Can I capitalize words to make the phrase stronger?
Only randomly chosen capitalization adds a choice. A fixed rule such as capitalizing every word adds formatting, not meaningful uncertainty.
Should every password be a passphrase?
No. A compact random password is normally simpler for credentials stored and filled by a manager.