Diceware Passphrases — Why Random Words Beat Complex Passwords
A passphrase is a sequence of randomly selected words used as a password. The Diceware method, developed by Arnold Reinhold, generates passphrases with provably high entropy by selecting words uniformly at random from a 7,776-word list. Five words gives 64 bits of entropy — stronger than most complex passwords and far easier to type from memory. This generator uses the browser's CSPRNG, giving the same randomness quality as physical dice.
4 words ≈ 51.7 bits | 5 words ≈ 64.6 bits | 6 words ≈ 77.5 bits | 7 words ≈ 90.4 bits. Each additional word adds 12.92 bits — roughly doubling crack time 13 times over.
Why Random Words Are Easier to Remember Than Random Characters
Human memory stores meaningful words far more efficiently than arbitrary character strings. A 20-character random password like 'kT#9mRpQ2x!vBnL7sE4w' is virtually impossible to memorize without a password manager. A 5-word passphrase like 'velvet-ramp-journal-fossil-blaze' — despite being 32 characters — can be recalled after a few repetitions because the brain uses semantic anchors. The memorability advantage is real and significant for passwords that must be typed from memory.
The Trap of Predictable Complexity
Mandatory complexity rules — 'must contain uppercase, digit, and symbol' — were intended to increase security but have the opposite effect in practice. They push users toward predictable patterns: capitalizing the first letter, appending a digit or exclamation mark, substituting common leet-speak (3 for e, 0 for o). Attackers model these patterns explicitly. The celebrated XKCD comic #936 quantified this: 'correct horse battery staple' has ~44 bits of entropy, while 'Tr0ub4dor&3' has only ~28 bits because the substitution pattern is predictable. Randomness, not complexity, is the security property that matters.
Where Passphrases Excel — and Their Limits
Passphrases shine for credentials that must be memorized and typed by humans: password manager master passwords, device login, full-disk encryption passphrases, and SSH key passphrases. They are not the right choice for every password — for most online accounts, a password manager generating a 20+ character random string is better and equally convenient. The passphrase advantage is specifically for the small set of credentials that must live in human memory.
NIST's Evolving Guidance
NIST SP 800-63B (2017) represented a major shift in official password guidance. It deprecated mandatory complexity rules and periodic password rotation (absent evidence of breach). It endorsed long passphrases, minimum length requirements (8 characters for user-chosen, 6 for system-generated OTPs), and checking against lists of commonly breached passwords. The core insight: length provides more measurable security than complexity requirements, and usability friction from complexity rules drives behavior — reuse, slight variations — that reduces real-world security.
Frequently Asked Questions
What is a passphrase?
A passphrase is a sequence of randomly selected words used as a password. Unlike a complex-but-short password like 'P@ssw0rd!', a passphrase like 'correct-horse-battery-staple' is longer (higher entropy) and far easier to remember. The critical requirement: the words must be selected randomly — not chosen by the user — to achieve the claimed security.
Are passphrases more secure than complex passwords?
Often yes, for equivalent memorability. A 5-word Diceware passphrase has about 64 bits of entropy. A typical human-chosen complex password like 'Tr0ub4dor&3' — despite looking strong — has roughly 28 bits because it follows predictable substitution patterns that attackers model explicitly. Randomness is what makes a password secure, not visual complexity or character variety.
How many words do I need in a passphrase?
4 words gives about 51 bits of entropy — adequate for many online accounts where rate limiting applies. 5 words gives 64 bits — a strong general-purpose threshold. 6 words gives 77 bits — suitable for high-value accounts and password manager master passwords. NIST SP 800-63B recommends allowing and encouraging long passphrases and explicitly recommends against mandating complexity rules.
What is the Diceware method?
Diceware is a passphrase generation method created by Arnold Reinhold in 1995. A standard die is rolled five times, and the result (e.g., 2-4-1-6-3 → 24163) maps to a word in a published 7,776-word list (6^5 = 7,776 possible combinations per word). Each word contributes log₂(7,776) ≈ 12.9 bits of entropy. This generator replicates the method using the browser's cryptographically secure random number generator (crypto.getRandomValues()) instead of physical dice.
What does NIST say about passphrases?
NIST Special Publication 800-63B (Digital Identity Guidelines) explicitly recommends allowing and encouraging long passphrases. It also recommends against mandatory complexity rules (forced uppercase, symbols, frequent expiration), as these drive predictable substitution patterns — 'Summer2024!' — without improving actual security. NIST's focus is password length and avoiding commonly used or previously breached passwords.
Can I use spaces in passphrases?
Yes. NIST recommends that password systems accept all printable characters including spaces. A passphrase like 'correct horse battery staple' with spaces is valid and arguably more readable than using hyphens. However, some legacy systems reject spaces or truncate long inputs — always verify that your target service supports long passphrases before relying on one.
Is a passphrase safe if someone knows I used Diceware?
Yes — Diceware's security does not depend on the method being secret (Kerckhoffs's principle). An attacker who knows you used a 5-word Diceware passphrase still must search 7,776^5 ≈ 28 quadrillion combinations. At 10 billion guesses per second, exhausting that space takes over 88,000 years on average. Security comes from the size of the search space, not secrecy of the method.