Generate Memorable Passphrases
That Are Easy to Remember, Hard to Crack

Recommendations by account type:

• Critical accounts (email, password manager): 6-7 words (78-90 bits entropy)
• High security (banking, financial): 5-6 words (65-78 bits entropy)
• Medium security (social media, shopping): 4 words (52 bits entropy)
• Low security (throwaway accounts): 3 words (39 bits entropy)

More words = exponentially more secure. Each additional word multiplies security by 7,776×!

Entropy measures the randomness (unpredictability) of your passphrase in bits. More entropy = harder to crack. Each bit doubles the number of possible combinations.

• 40 bits = 1 trillion combinations (weak, crackable in days)
• 52 bits = 4 quadrillion combinations (moderate, months to crack)
• 65 bits = 36 quintillion combinations (strong, centuries to crack)
• 78+ bits = practically uncrackable with current technology

A 5-word passphrase with the EFF Long Wordlist provides ~65 bits of entropy — far stronger than most "complex" passwords like "P@ssw0rd123!" (which only has ~28 bits).

Separators improve readability without significantly affecting security. The choice is mostly personal preference:

• Dashes (-): Most common, works everywhere, easy to type
• Spaces ( ): Most readable, but some systems don't allow spaces
• Dots (.): Clean look, accepted by most systems
• No separator: "correcthorsebatterystaple" — harder to read but valid

Pro tip: Use different separators for different account types to avoid confusion. For example: dashes for banking, dots for social media, spaces for personal accounts.

You can, but you probably shouldn't. Manual modifications often reduce security because humans are predictable. Common patterns like changing "correct" to "c0rrect" or adding "123!" at the end are exactly what attackers check first.

Better alternatives:

• Enable "Add Numbers" or "Add Symbols" options — adds random digits/symbols between words
• Use "Capitalize Words" if the system requires uppercase letters
• Generate a new passphrase until you get one you like

These options maintain cryptographic randomness while meeting specific requirements.

Create a mental story! Our brains are wired to remember narratives and images.

Example: For "umbrella-cricket-diamond-planet-wizard"

"An umbrella-wielding cricket found a diamond on a distant planet where a mysterious wizard lived."

The more vivid and silly the story, the easier it is to remember. Turn abstract words into a memorable movie scene in your mind!

Practice: Type it 10 times in a row. Repeat before bed for 3 nights. You'll never forget it.

YES! Absolutely! Strong passphrases protect against brute-force and dictionary attacks, but they can't protect against phishing or keyloggers.

Layered security:

• Strong passphrase = First line of defense against cracking attempts
• 2FA (TOTP/hardware key) = Second line of defense against phishing and stolen credentials

Together, they make your accounts virtually unbreakable. Enable 2FA on all critical accounts (email, banking, password manager) using apps like Google Authenticator, Authy, or hardware keys like YubiKey.