Password vs passphrase: which is stronger, measured in bits

A password and a passphrase are judged by the same measure: how many guesses an attacker needs. If the secret was chosen at random, that number can be calculated exactly, and six random dictionary words turn out to be worth about as much as twelve random keyboard characters. If a person chose it, the calculation breaks down and the true figure is far lower. This guide gives the calculated figures for both kinds, shows where the formula stops applying, and sets out what the current NIST guidance says. The tables were produced by the same code as our strong password generator and passphrase generator.

What entropy means

If a secret is one of N equally likely possibilities, its entropy is log₂ N bits. Each extra bit doubles the number of possibilities.

• A random password of length L from a set of C characters has C^L possibilities, so L × log₂ C bits. One character from the 94 printable keyboard characters is worth log₂ 94 = 6.55 bits.
• A random passphrase of W words from a list of 7,776 has 7,776^W possibilities, so W × log₂ 7,776 = W × 12.92 bits.

The phrase that matters is equally likely: the formula describes the process that made the secret, not the text. tidy-lumber-crisp drawn by a random number generator has 38.8 bits. The same three words chosen because you like them have much less.

Random passwords: entropy by length and character set

Computed by the strong password generator with “Include at least one of each chosen type” unticked, so every character is drawn from the whole pool. Figures are in bits.

Length	Digits only (10)	Lowercase (26)	Lowercase + digits (36)	Upper + lower + digits (62)	All four sets (94)
8	26.6	37.6	41.4	47.6	52.4
10	33.2	47.0	51.7	59.5	65.5
12	39.9	56.4	62.0	71.5	78.7
14	46.5	65.8	72.4	83.4	91.8
15	49.8	70.5	77.5	89.3	98.3
16	53.2	75.2	82.7	95.3	104.9
20	66.4	94.0	103.4	119.1	131.1

At 12 characters, going from lowercase only to all four sets adds 22.3 bits. Going from 12 to 16 lowercase letters adds 18.8 bits and needs no shift key. Length does most of the work.

With the “at least one of each” box ticked, which is the generator’s default, a few combinations are ruled out and the tool reports the exact smaller figure: 51.3 bits at 8 characters with all four sets, and 130.9 at 20.

Random passphrases: entropy by word count

Computed by the passphrase generator, which draws from the EFF Large Wordlist. That list has 7,776 words because 7,776 = 6⁵, one word for every possible roll of five dice.

Words	Entropy	With one random digit added	Random 94-character password of similar strength
4	51.7 bits	57.0 bits	8 characters (52.4 bits)
5	64.6 bits	70.3 bits	10 characters (65.5 bits)
6	77.5 bits	83.5 bits	12 characters (78.7 bits)
7	90.5 bits	96.6 bits	14 characters (91.8 bits)
8	103.4 bits	109.7 bits	16 characters (104.9 bits)
10	129.2 bits	135.9 bits	20 characters (131.1 bits)

One word is worth almost exactly two random keyboard characters (12.92 against 2 × 6.55 = 13.1 bits). The EFF suggests six words for most uses and counts 221,073,919,720,733,357,899,776 possible passphrases, “about 2⁷⁷”, matching the table.

Capitalising every word and choosing a separator add nothing, because they are fixed choices an attacker can assume. The “Add one random digit to a random word” option adds log₂(10 × words) bits, 5.9 at six words, because both the digit and its position are random. And the entropy counts only the random choices, not the letters: a six-word passphrase is often more than 40 characters long, but it is still one of 7,776⁶ possibilities.

Why passwords people choose are far weaker

The formula assumes a random draw. People pick words, names, dates and keyboard patterns, and they satisfy “one capital, one digit, one symbol” rules in the same few ways. NIST’s Appendix A gives the standard example: someone who would have chosen “password” picks “Password1” when a capital and a number are required, and “Password1!” when a symbol is demanded too.

Our password strength tester shows the gap between the formula (“If it were random”) and what remains once it spots a known pattern (“Estimated entropy”).

Typed in	If it were random	Estimated entropy	Why
Summer2024!	72.3 bits	38.0 bits	A common password (“summer”) with five characters added, including a year
P@ssw0rd	52.6 bits	10.8 bits	On the common-password list once the symbol swaps are undone
qwerty	28.2 bits	9.7 bits	On the common-password list, and a keyboard row

Treat even the lower figure as a ceiling. The tester checks 911 very common passwords, sequences, repeats and years; its own notice says names, dictionary words and dates make a password weaker than shown. Type in the famous “correct horse battery staple” and it reports 164.7 bits, because it counts 28 characters and does not recognise words. Four words drawn at random from the EFF list are worth 51.7 bits, and that particular phrase, being famous, is worth nothing. No checker can see how a secret was chosen.

What the numbers mean in guessing time

Any “time to crack” depends on an assumed guess rate, so here is ours. Suppose a site’s database leaks and the passwords were stored with a fast, unsalted hash, so an attacker can test 10¹⁰ (ten billion) guesses a second, the rate our strength tester also assumes. NIST’s appendix describes offline attackers computing “many billions of hashes per second”. On average the attacker finds a random secret after trying half the possibilities, so the time is 2^(bits − 1) ÷ 10¹⁰ seconds.

Secret	Bits	Average guesses	Time at 10¹⁰ guesses per second
8 random characters (94)	52.4	3.05 × 10¹⁵	3.05 × 10⁵ s, about 85 hours
4 random words	51.7	1.83 × 10¹⁵	1.83 × 10⁵ s, about 51 hours
5 random words	64.6	1.42 × 10¹⁹	1.42 × 10⁹ s, about 45 years
6 random words	77.5	1.11 × 10²³	1.11 × 10¹³ s, about 350,000 years
12 random characters (94)	78.7	2.38 × 10²³	2.38 × 10¹³ s, about 754,000 years

These are illustrations. A site that salts its passwords and runs them through a deliberately slow hashing scheme cuts the guess rate by orders of magnitude. Guessing through a login page is slower still: NIST requires services to limit consecutive failed attempts on an account to no more than 100. And none of it applies to a human-chosen password, which falls to a word list long before brute force matters.

What NIST SP 800-63B recommends now

The current edition is Revision 4 (SP 800-63B-4, July 2025). It is written for the services that check passwords, not for individuals, but it shapes the rules you meet at sign-up. Section 3.1.1.2 says that verifiers:

• shall require at least 15 characters when a password is the only factor, and at least 8 when it is used only as part of multi-factor authentication;
• should permit a maximum length of at least 64 characters, and accept all printing ASCII characters, the space character and Unicode;
• “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)”;
• “SHALL NOT require subscribers to change passwords periodically”, but shall force a change when there is evidence of compromise;
• shall compare a new password against a blocklist of commonly used, expected or compromised passwords;
• shall not permit a stored hint that someone who is not logged in can see, or prompt for security questions;
• shall allow password managers and autofill, and should permit pasting.

The 2017 edition (Revision 3) set an 8-character minimum and said verifiers “SHOULD NOT” impose composition rules or periodic changes; Revision 4 raises the single-factor minimum to 15 and makes both “SHALL NOT”. Its appendix gives the reasoning: length is “a primary factor” in password strength, composition rules produce predictable choices, and passphrases are “often an effective way to create a longer password”.

Password managers and a second factor

NIST notes that password managers make people more likely to choose stronger passwords, particularly when they include a generator. So use a passphrase for the few secrets you must type from memory, such as the manager itself and your device login, and let the manager generate a long random password for everything else.

Length does not help against every attack. NIST states that “passwords are not phishing-resistant”, and that keystroke logging, phishing and social engineering work as well against long passwords as short ones. A second factor answers those: an authenticator app with time-based codes or, better, a passkey or security key. Our OTP code generator shows how such codes are derived from a shared secret.

On the storage side, NIST requires services to salt and hash passwords with a scheme that has a cost factor. The SHA-256 generator is built to be fast, which suits checksums and also suits an attacker; the bcrypt generator takes longer as you raise its “Cost factor”, each step doubling the work.

How the numbers are worked out

Every entropy figure is log₂ of the exact number of possibilities: the character pool after your options, raised to the length, or 7,776 raised to the number of words. You can confirm any cell by hand: 16 × log₂ 94 = 16 × 6.5546 = 104.9.

To check against the tools, open the strong password generator, set “Length”, tick the character sets and read “Entropy”. In the passphrase generator, set “Number of words” and read “Entropy”; the “Word list” line shows 7,776 words at 12.92 bits each. Both use the browser’s cryptographic random generator. The strength labels (very weak under 28 bits, weak under 36, fair under 60, strong under 80, very strong above) are this site’s own bands, not a standard.

The tools cannot tell whether a password has appeared in a breach or been reused. Avoid typing live passwords into any web page, including ours.

Related tools

• Strong password generator: random passwords from 4 to 128 characters, with exact entropy.
• Passphrase generator: 3 to 12 words from the EFF Large Wordlist.
• Password strength tester: the formula figure beside a pattern-adjusted estimate.
• Bcrypt hash generator and SHA-256 hash generator: a slow password hash beside a fast checksum.
• OTP code generator: time-based one-time codes from a Base32 secret.