Menu

Search toolsChangelog

to move to openDescribe the problem, not the tool

Guide answer

How many random words should a passphrase use?

Four genuinely random words from a 7,776-word Diceware-style list provide about 51 bits of entropy; five provide about 64 bits. That is strong for many ordinary online accounts when the passphrase is unique and the site limits guessing, while a password manager can generate more for a high-value secret. The word count means nothing if you choose the words yourself, quote a familiar phrase, or reuse it—those choices are not equally likely and therefore do not carry the calculated entropy.

What to take away
  1. Entropy comes from the random selection process and list size, not from how unusual the finished phrase looks.

  2. Add another random word for a high-value or offline-guessable secret; each word from a 7,776-item list adds about 12.9 bits.

  3. Keep every passphrase unique and use multi-factor authentication; strength cannot contain the damage from reuse.

The full explanation

Composition rules — one capital, one digit, one symbol — measure the wrong thing and push people toward predictable patterns. What resists guessing is entropy: how many equally likely possibilities the generator could have produced. Modern guidance has moved to length and blocklists, and away from the rules almost every site still enforces. Read the complete guide for the reasoning, examples and definitions behind this answer.

Use the idea

Sources