Why words instead of characters
A passphrase of five or six random words is as hard to guess as a long string of random characters, but far easier to type and remember. What makes it strong is that the words are picked at random from a list of 7,776, not chosen by a person. A well-known phrase or song line is not random, however long it is.
How strength is calculated
Strength is measured in bits of entropy: every extra bit doubles the number of possibilities an attacker has to try. Each random word adds almost 13 bits, so five words give about 65 bits and six words about 78. That is why the generator starts at six.
The time shown assumes an attacker who has stolen a password database and can try 100 billion guesses per second, which is realistic for a weakly protected database and fast hardware. Against a login page with rate limits, the same password holds out vastly longer.
Where to use it
- The master password of your password manager. This is the one password worth memorising. Let the password manager generate and remember all the others.
- Your computer login and disk encryption, where a password manager can’t fill it in for you.
A strong password still doesn’t help if it leaks through a phishing page. Turn on two-factor authentication for every account that supports it.